CVE-2026-56697

MEDIUM

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Title source: cna
STIX 2.1

Description

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.

References (4)

Core 4
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-c9cv-mq2m-ppp3)
https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
Third Party Advisory third-party-advisory
VulnCheck Advisory: Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
https://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp

Scores

CVSS v3 6.1
EPSS 0.0034
EPSS Percentile 26.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-601
Status published
Products (5)
Nuxt/Nuxt < 3.21.7
nuxt/nuxt 3.0.0 - 3.21.7
Nuxt/Nuxt 3.21.7
Nuxt/Nuxt 4.0.0 - 4.4.7
Nuxt/Nuxt 4.4.7
Published Jun 22, 2026
Tracked Since Jun 23, 2026