CVE-2026-56697: Nuxt Nuxt XSS Vulnerability

CVE-2026-56697 Overview

CVE-2026-56697 is an open redirect vulnerability [CWE-601] in the Nuxt web framework. The flaw exists in the reloadNuxtApp function within packages/nuxt/src/app/composables/chunk.ts. The function rejects script-like protocols such as javascript: and data: but fails to block protocol-relative paths like //evil.com. These paths resolve against the current page protocol and produce cross-origin navigations.

Nuxt versions 4.0.0 through 4.4.6 and 3.x before 3.21.7 are affected. Attackers can supply crafted paths to redirect authenticated users to attacker-controlled hosts. This enables phishing campaigns and theft of OAuth authorization codes when redirect parameters flow into reloadNuxtApp.

Critical Impact
Authenticated users can be silently redirected to attacker-controlled domains, enabling phishing and OAuth authorization-code interception.

Affected Products

Nuxt 4.0.0 through 4.4.6
Nuxt 3.x versions before 3.21.7
Applications using the reloadNuxtApp composable with user-controlled path input

Discovery Timeline

2026-06-22 - CVE-2026-56697 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56697

Vulnerability Analysis

The reloadNuxtApp composable accepts a path parameter that controls where the browser navigates after a reload. The pre-patch validation logic blocked URLs starting with script-like protocols, including javascript: and data:. However, the check did not normalize protocol-relative inputs.

A path beginning with // is treated by browsers as a network-path reference. The browser inherits the current page protocol and resolves the remainder as a fully qualified cross-origin URL. Submitting //evil.com therefore navigates the user to https://evil.com without tripping the script-protocol guard.

Root Cause

The input validation in chunk.ts performed protocol allow-listing without origin verification. The function failed to confirm that the resolved URL pointed to the same origin as the current document. This omission is a classic URL redirection to untrusted site weakness tracked as [CWE-601].

Attack Vector

Exploitation requires user interaction, typically clicking a crafted link. An attacker constructs a URL where a query parameter feeding reloadNuxtApp contains //attacker.tld/oauth/callback. After the application calls reload, the browser navigates off-origin. For OAuth flows, the attacker can capture the authorization code appended to the redirect target.

The following patch diff shows the corrective comment and behavior change applied to chunk.ts:

typescript

    * The path to reload. If this is different from the current window location it will
    * trigger a navigation and add an entry in the browser history.
    *
-   * URLs with script-like protocols (e.g. `javascript:`, `data:`) are rejected.
+   * Cross-origin paths and URLs with script-like protocols (e.g. `javascript:`, `data:`) are rejected.
    * @default {window.location.pathname}
    */
   path?: string

Source: Nuxt commit 6497d99 and Nuxt commit e447a79

Detection Methods for CVE-2026-56697

Indicators of Compromise

HTTP referer headers showing navigation from your Nuxt application to unexpected external domains
Query parameters or POST bodies containing protocol-relative values such as // prefixed strings reaching reloadNuxtApp
OAuth callback requests landing on hosts not registered in your identity provider
Spikes in 302 redirects originating from Nuxt-rendered routes

Detection Strategies

Inspect application logs for reloadNuxtApp invocations where the path argument starts with //, \\, or contains a domain component
Deploy web application firewall rules that flag inbound URLs with protocol-relative path parameters
Audit OAuth provider logs for authorization codes redeemed by clients outside the expected redirect URI allow-list
Use code scanning to locate every call site of reloadNuxtApp and confirm path values are validated against a same-origin allow-list

Monitoring Recommendations

Forward Nuxt server and CDN access logs to a centralized SIEM and alert on outbound redirect anomalies
Track the Nuxt dependency version across build pipelines and fail builds running vulnerable releases
Monitor browser telemetry or RUM data for cross-origin navigations originating from authenticated routes

How to Mitigate CVE-2026-56697

Immediate Actions Required

Upgrade Nuxt to 4.4.7 or later for the 4.x branch, or 3.21.7 or later for the 3.x branch
Audit application source for direct or indirect user input flowing into reloadNuxtApp
Rotate any OAuth client secrets and review recent authorization-code grants for suspicious redirect URIs
Notify users if you identify successful exploitation traffic in historical logs

Patch Information

The fix is implemented in commits 6497d99 and e447a79. The patched logic rejects cross-origin paths in addition to script-like protocols. See the GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 and the VulnCheck Advisory for full details.

Workarounds

Wrap reloadNuxtApp calls in a helper that validates paths begin with a single / and reject any string containing // or \\
Strip protocol-relative prefixes from user-supplied redirect parameters before passing them to the composable
Restrict OAuth provider configurations to an explicit allow-list of redirect URIs that cannot be expanded by query parameters

bash

# Upgrade Nuxt to a patched release
npm install nuxt@^4.4.7
# or for the 3.x branch
npm install nuxt@^3.21.7