{"id":"CVE-2025-59414","aliases":["CLSA-2026-1775867594","CLSA-2026-1775867597","CLSA-2026-1788450984","CLSA-2026-1792161441","CLSA-2026-1792161442","CLSA-2026-1792161460","CLSA-2026-1792161481","CLSA-2026-1792161581","CLSA-2026-1792161582","CLSA-2026-1792161601","CLSA-2026-1792161804","CLSA-2026-1792161806","CLSA-2026-1792161823","CLSA-2026-1792161917","CLSA-2026-1792161919","CLSA-2026-1792161936","EUVD-2025-29762","GHSA-p6jq-8vc4-79f6"],"status":"published","title":"Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00369,"percentile":0.31154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-09-17T18:39:38Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["3.19.0","4.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nuxt","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/kit","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/schema","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","fixed_in":["4.0.3-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.0"},{"fixed":"3.19.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.1"}]}],"versions":["4.0.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.6.0"},{"fixed":"3.19.0"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.0"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6","tags":["x_refsource_CONFIRM","Exploit","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59414","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p6jq-8vc4-79f6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59414.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-59414","title":"Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.","status":"published","published":"2025-09-17T18:39:38.193Z","modified":"2025-09-17T19:42:44.734Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-29762","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.","status":"published","published":"2025-09-17T18:39:38Z","modified":"2025-09-17T19:42:44Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T20:31:42.206486Z"}],"ghsa":[{"id":"GHSA-p6jq-8vc4-79f6","title":"Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival","description":"### Summary\n\nA client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.\n\n### Technical Details\n\nThe vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized `__nuxt_island` objects. The issue affects the following flow:\n\n1. During prerendering, if an API endpoint returns user-controlled data containing a crafted `__nuxt_island` object\n2. This data gets serialized with `devalue.stringify` and stored in the prerendered page\n3. When a client navigates to the prerendered page, `devalue.parse` deserializes the payload\n4. The Island reviver attempts to fetch `/__nuxt_island/${key}.json` where `key` could contain path traversal sequences\n\n### Prerequisites for Exploitation\n\nThis vulnerability requires **all** of the following conditions:\n\n1. **Prerendered pages**: The application must use Nuxt's prerendering feature (`nitro.prerender`)\n2. **Attacker-controlled API responses**: The attacker must be able to control the response content of an API endpoint that is called during prerendering via `useFetch`, `useAsyncData`, or similar composables\n3. **Client-side navigation**: A user must navigate to the prerendered page (not during initial SSR hydration)\n\n### Attack Scenario\n\n```javascript\n// Malicious API response during prerendering\n{\n  \"__nuxt_island\": {\n    \"key\": \"../../../../internal/service\",\n    \"params\": { \"action\": \"probe\" }\n  }\n}\n```\n\nThis could cause the client to make requests to `/__nuxt_island/../../../../internal/service.json` if path traversal is not properly handled by the server.\n\n### Impact Assessment\n\n- **Limited Impact**: The vulnerability has a low severity due to the highly specific prerequisites\n- **No Direct Data Exfiltration**: The vulnerability does not directly expose sensitive data\n- **Client-Side Only**: Requests originate from the client, not the server\n\n### Mitigation\n\n**Action Required:**\n- Update to Nuxt 3.19.0+ or 4.1.0+ immediately\n- Review any prerendered pages that fetch external or user-controlled data\n\n**Temporary Workarounds** (if immediate update is not possible):\n1. Disable prerendering for pages that fetch user-controlled data\n2. Implement strict input validation on API endpoints used during prerendering\n3. Use allowlists for API response structures during prerendering\n\n### Fix Details\n\n[The fix](https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595) implemented validation for Island keys in `revive-payload.server.ts`:\n- Island keys must match the pattern `/^[a-z][a-z\\d-]*_[a-z\\d]+$/i`\n- Maximum length of 100 characters\n- Prevents path traversal and special characters","status":"published","published":"2025-09-17T20:42:28Z","modified":"2025-09-18T13:04:22Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2025-59414","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.","status":"published","published":"2025-09-17T19:15:47.437Z","modified":"2026-06-17T09:46:07.52Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:29.650057Z"}],"osv":[{"id":"CVE-2025-59414","title":"Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met. The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. During prerendering, if an API endpoint returns user-controlled data containing a crafted __nuxt_island object, he data gets serialized with devalue.stringify and stored in the prerendered page. When a client navigates to the prerendered page, devalue.parse deserializes the payload. The Island reviver attempts to fetch /__nuxt_island/${key}.json where key could contain path traversal sequences. Update to Nuxt 3.19.0+ or 4.1.0+.","status":"published","published":"2025-09-17T18:39:38.193Z","modified":"2026-11-11T10:30:32.654879835Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-11T11:06:35.471389Z"},{"id":"GHSA-p6jq-8vc4-79f6","title":"Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival","description":"### Summary\n\nA client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.\n\n### Technical Details\n\nThe vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized `__nuxt_island` objects. The issue affects the following flow:\n\n1. During prerendering, if an API endpoint returns user-controlled data containing a crafted `__nuxt_island` object\n2. This data gets serialized with `devalue.stringify` and stored in the prerendered page\n3. When a client navigates to the prerendered page, `devalue.parse` deserializes the payload\n4. The Island reviver attempts to fetch `/__nuxt_island/${key}.json` where `key` could contain path traversal sequences\n\n### Prerequisites for Exploitation\n\nThis vulnerability requires **all** of the following conditions:\n\n1. **Prerendered pages**: The application must use Nuxt's prerendering feature (`nitro.prerender`)\n2. **Attacker-controlled API responses**: The attacker must be able to control the response content of an API endpoint that is called during prerendering via `useFetch`, `useAsyncData`, or similar composables\n3. **Client-side navigation**: A user must navigate to the prerendered page (not during initial SSR hydration)\n\n### Attack Scenario\n\n```javascript\n// Malicious API response during prerendering\n{\n  \"__nuxt_island\": {\n    \"key\": \"../../../../internal/service\",\n    \"params\": { \"action\": \"probe\" }\n  }\n}\n```\n\nThis could cause the client to make requests to `/__nuxt_island/../../../../internal/service.json` if path traversal is not properly handled by the server.\n\n### Impact Assessment\n\n- **Limited Impact**: The vulnerability has a low severity due to the highly specific prerequisites\n- **No Direct Data Exfiltration**: The vulnerability does not directly expose sensitive data\n- **Client-Side Only**: Requests originate from the client, not the server\n\n### Mitigation\n\n**Action Required:**\n- Update to Nuxt 3.19.0+ or 4.1.0+ immediately\n- Review any prerendered pages that fetch external or user-controlled data\n\n**Temporary Workarounds** (if immediate update is not possible):\n1. Disable prerendering for pages that fetch user-controlled data\n2. Implement strict input validation on API endpoints used during prerendering\n3. Use allowlists for API response structures during prerendering\n\n### Fix Details\n\n[The fix](https://github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595) implemented validation for Island keys in `revive-payload.server.ts`:\n- Island keys must match the pattern `/^[a-z][a-z\\d-]*_[a-z\\d]+$/i`\n- Maximum length of 100 characters\n- Prevents path traversal and special characters","status":"published","published":"2025-09-17T20:42:28Z","modified":"2025-09-18T13:04:21Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"CLSA-2026-1775867594","title":"TuxCare security update for nuxt (4 CVEs)","description":"TuxCare rebuilt nuxt to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:36.988257257Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775867597","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:36.800947672Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1788450984","title":"TuxCare security update for nuxt (11 CVEs)","description":"TuxCare rebuilt nuxt to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-09-03T15:56:24Z","modified":"2026-10-15T09:48:03.152914241Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792161441","title":"TuxCare security update for @nuxt/kit (4 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:37:21Z","modified":"2026-10-16T16:31:02.438072296Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161442","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-10-16T14:37:22Z","modified":"2026-10-16T16:31:02.417573785Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161460","title":"TuxCare security update for @nuxt/kit (11 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:37:40Z","modified":"2026-10-16T16:31:03.072757342Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161481","title":"TuxCare security update for @nuxt/rspack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-10-16T14:38:01Z","modified":"2026-10-16T16:31:03.825712802Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161581","title":"TuxCare security update for @nuxt/schema (4 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:39:41Z","modified":"2026-10-16T16:31:11.742633867Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161582","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-10-16T14:39:42Z","modified":"2026-10-16T16:31:11.744943966Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161601","title":"TuxCare security update for @nuxt/schema (11 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:40:01Z","modified":"2026-10-16T16:31:05.866570588Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161804","title":"TuxCare security update for @nuxt/vite-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:43:24Z","modified":"2026-10-16T16:30:33.702461081Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161806","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-10-16T14:43:26Z","modified":"2026-10-16T16:30:33.704713133Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161823","title":"TuxCare security update for @nuxt/vite-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:43:43Z","modified":"2026-10-16T16:30:34.584872899Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161917","title":"TuxCare security update for @nuxt/webpack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:45:17Z","modified":"2026-10-16T16:31:41.011961884Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161919","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 4.0.3-tuxcare.1.","status":"published","published":"2026-10-16T14:45:19Z","modified":"2026-10-16T16:30:34.584578015Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161936","title":"TuxCare security update for @nuxt/webpack-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:45:36Z","modified":"2026-10-16T16:31:30.28168697Z","updated_at":"2026-11-02T15:43:51.213191Z"}]}}