{"id":"CVE-2026-71318","aliases":["CLSA-2026-1788450984","CLSA-2026-1789598338","CLSA-2026-1792161460","CLSA-2026-1792161463","CLSA-2026-1792161485","CLSA-2026-1792161601","CLSA-2026-1792161604","CLSA-2026-1792161823","CLSA-2026-1792161826","CLSA-2026-1792161936","CLSA-2026-1792161939","EUVD-2026-53647","GHSA-48hr-524c-v5w3"],"status":"published","title":"Nuxt: Unauthorized Component Instantiation via Server Island Props","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through \u003ccomponent :is\u003e, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00315,"percentile":0.24784,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-08-05T21:21:30Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.5.1","3.21.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.2","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.10","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-48hr-524c-v5w3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71318.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71318","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-71318","title":"Nuxt: Unauthorized Component Instantiation via Server Island Props","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through \u003ccomponent :is\u003e, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:21:30.509Z","modified":"2026-08-06T14:49:15.403Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53647","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through \u003ccomponent :is\u003e, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:21:30Z","modified":"2026-08-06T14:49:15Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:08.553271Z"}],"ghsa":[{"id":"GHSA-48hr-524c-v5w3","title":"Nuxt: Unauthorized Component Instantiation via Server Island Props","description":"## Impact\n\nNuxt server islands accept props via the `/__nuxt_island/` endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.\n\nFor example:\n```json\n{ \"as\": \"SomeGlobalComponent\" }\n```\n\n...resolves and renders `SomeGlobalComponent` if it is globally registered, even though the attacker should only be able to drive props for the island's declared component. Similarly, `{ \"as\": \"iframe\" }` renders an `\u003ciframe\u003e` element.\n\nUnlike the primary RCE vector (GHSA-9473-5f9j-94wq), this does **not** require `vue.runtimeCompiler` to be enabled. A plain string prop is sufficient to trigger component resolution. The `template`/`render` key guard that addresses the RCE vector does not block plain string values.\n\nSome component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `\u003ccomponent :is\u003e`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value inside a server island. Note this does not require explicit prop forwarding: island props the island component does not declare fall through as attributes onto its single root element, so an island whose root is a `reka-ui` / `@nuxt/ui` component receives the attacker's `as` value implicitly. Unlike the RCE vector, no `vue.runtimeCompiler` is required, which makes this vector reachable in more configurations. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink. Installing `@nuxt/ui` does not by itself register any component as a server island: the application must define the island (a `.server.vue` file).\n\n## Mitigating factors\n\n- Exploitation requires a server island component that puts an attacker-controlled value onto a dynamic-component path (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, `h()`, or a polymorphic `as` / `asChild` prop), either explicitly or via attribute fallthrough when the island's root is such a component.\n- Reachable components are limited to what is actually in the island app's global registry. In a default pages-enabled app that is `RouterView` and `RouterLink` (both registered globally by the pages router plugin, which runs even in component islands), plus any `components/global/` component and any component a module registers globally. `RouterLink` in particular renders an attacker-influenced `\u003ca\u003e` (and, because an island that declares no props forwards all props, `to` and other `RouterLink` props ride the same fallthrough). Vue built-ins (`Transition`, `KeepAlive`, `Teleport`, `Suspense`) and Nuxt auto-imports (`ClientOnly`, `NuxtLink`, `NuxtPage`, etc.) are NOT in the island app's global registry and cannot be resolved this way; an unresolved name instead renders as a native HTML element (the element-injection half of this issue).\n- Declaring the props an island accepts, or setting `inheritAttrs: false` on it, prevents an undeclared `as` from falling through to a polymorphic root and neutralizes this vector.\n- Arbitrary JavaScript execution is not possible through this vector (no `template`/`render` compilation).\n- Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.\n\n## Affected versions\n\nNuxt `\u003e=3.1.0 \u003c3.21.10` and `\u003e=4.0.0 \u003c4.5.1`, with component islands active. The island prop-forwarding behavior has existed since server islands were introduced in v3.1.0, and this vector does not depend on `vue.runtimeCompiler`. Nuxt 2 is not affected.\n\nNote the patch (below) closes the implicit attribute-fallthrough path, which is the majority case. An island that *explicitly* forwards an untrusted prop into dynamic component resolution (or forwards it under a prop name other than `as`) remains the application's responsibility in every version; see Workarounds.\n\n## Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. Patched releases reject a top-level `as` island prop (HTTP 400 at the `/__nuxt_island/` endpoint). This closes the implicit path: island props an island does not declare fall through as attributes onto its single root, so a top-level `as` would otherwise reach a polymorphic root component's `as` prop (the `reka-ui` / `@nuxt/ui` convention) and drive dynamic component resolution without the author binding it. Rejecting the top-level `as` prop blocks that fallthrough while leaving nested data and other prop names untouched.\n\nThe framework deliberately does not attempt to block every case: it cannot safely tell a string used as data from one used as a component selector, and it has no island-local hook into Vue's `h()` or `resolveDynamicComponent()`. An island that explicitly forwards an untrusted value into `\u003ccomponent :is\u003e` / `h()` / `resolveDynamicComponent()`, or that forwards it under a different polymorphic prop name, is therefore not covered by the patch and must follow the guidance below. The Nuxt documentation now warns against this.\n\n## Workarounds\n\nUpgrade to `nuxt@4.5.1` or `nuxt@3.21.10`. That upgrade also removes the related object-prop RCE (GHSA-9473-5f9j-94wq). In addition, in any version:\n\n1. Do not forward island props into `\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`. Map an untrusted discriminator through a closed allowlist of imported component definitions instead of passing the raw prop value.\n2. Declare the props an island accepts, or set `inheritAttrs: false` on it, so request input cannot fall through to a polymorphic root component.\n3. Avoid registering sensitive components globally that could leak information if instantiated by an attacker.","status":"published","published":"2026-08-05T21:21:33Z","modified":"2026-08-05T21:21:34Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71318","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through \u003ccomponent :is\u003e, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T22:17:08.083Z","modified":"2026-09-08T20:51:43.49Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71318","title":"Nuxt: Unauthorized Component Instantiation via Server Island Props","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through \u003ccomponent :is\u003e, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:21:30.509Z","modified":"2026-10-28T02:30:47.391616256Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-48hr-524c-v5w3","title":"Nuxt: Unauthorized Component Instantiation via Server Island Props","description":"## Impact\n\nNuxt server islands accept props via the `/__nuxt_island/` endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.\n\nFor example:\n```json\n{ \"as\": \"SomeGlobalComponent\" }\n```\n\n...resolves and renders `SomeGlobalComponent` if it is globally registered, even though the attacker should only be able to drive props for the island's declared component. Similarly, `{ \"as\": \"iframe\" }` renders an `\u003ciframe\u003e` element.\n\nUnlike the primary RCE vector (GHSA-9473-5f9j-94wq), this does **not** require `vue.runtimeCompiler` to be enabled. A plain string prop is sufficient to trigger component resolution. The `template`/`render` key guard that addresses the RCE vector does not block plain string values.\n\nSome component libraries expose a polymorphic `as` / `asChild` prop that forwards its value into `\u003ccomponent :is\u003e`; `@nuxt/ui` (via `reka-ui`) is a widely used example. An application is affected if such a component receives the attacker-controlled value inside a server island. Note this does not require explicit prop forwarding: island props the island component does not declare fall through as attributes onto its single root element, so an island whose root is a `reka-ui` / `@nuxt/ui` component receives the attacker's `as` value implicitly. Unlike the RCE vector, no `vue.runtimeCompiler` is required, which makes this vector reachable in more configurations. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink. Installing `@nuxt/ui` does not by itself register any component as a server island: the application must define the island (a `.server.vue` file).\n\n## Mitigating factors\n\n- Exploitation requires a server island component that puts an attacker-controlled value onto a dynamic-component path (`\u003ccomponent :is\u003e`, `resolveDynamicComponent`, `h()`, or a polymorphic `as` / `asChild` prop), either explicitly or via attribute fallthrough when the island's root is such a component.\n- Reachable components are limited to what is actually in the island app's global registry. In a default pages-enabled app that is `RouterView` and `RouterLink` (both registered globally by the pages router plugin, which runs even in component islands), plus any `components/global/` component and any component a module registers globally. `RouterLink` in particular renders an attacker-influenced `\u003ca\u003e` (and, because an island that declares no props forwards all props, `to` and other `RouterLink` props ride the same fallthrough). Vue built-ins (`Transition`, `KeepAlive`, `Teleport`, `Suspense`) and Nuxt auto-imports (`ClientOnly`, `NuxtLink`, `NuxtPage`, etc.) are NOT in the island app's global registry and cannot be resolved this way; an unresolved name instead renders as a native HTML element (the element-injection half of this issue).\n- Declaring the props an island accepts, or setting `inheritAttrs: false` on it, prevents an undeclared `as` from falling through to a polymorphic root and neutralizes this vector.\n- Arbitrary JavaScript execution is not possible through this vector (no `template`/`render` compilation).\n- Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.\n\n## Affected versions\n\nNuxt `\u003e=3.1.0 \u003c3.21.10` and `\u003e=4.0.0 \u003c4.5.1`, with component islands active. The island prop-forwarding behavior has existed since server islands were introduced in v3.1.0, and this vector does not depend on `vue.runtimeCompiler`. Nuxt 2 is not affected.\n\nNote the patch (below) closes the implicit attribute-fallthrough path, which is the majority case. An island that *explicitly* forwards an untrusted prop into dynamic component resolution (or forwards it under a prop name other than `as`) remains the application's responsibility in every version; see Workarounds.\n\n## Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. Patched releases reject a top-level `as` island prop (HTTP 400 at the `/__nuxt_island/` endpoint). This closes the implicit path: island props an island does not declare fall through as attributes onto its single root, so a top-level `as` would otherwise reach a polymorphic root component's `as` prop (the `reka-ui` / `@nuxt/ui` convention) and drive dynamic component resolution without the author binding it. Rejecting the top-level `as` prop blocks that fallthrough while leaving nested data and other prop names untouched.\n\nThe framework deliberately does not attempt to block every case: it cannot safely tell a string used as data from one used as a component selector, and it has no island-local hook into Vue's `h()` or `resolveDynamicComponent()`. An island that explicitly forwards an untrusted value into `\u003ccomponent :is\u003e` / `h()` / `resolveDynamicComponent()`, or that forwards it under a different polymorphic prop name, is therefore not covered by the patch and must follow the guidance below. The Nuxt documentation now warns against this.\n\n## Workarounds\n\nUpgrade to `nuxt@4.5.1` or `nuxt@3.21.10`. That upgrade also removes the related object-prop RCE (GHSA-9473-5f9j-94wq). In addition, in any version:\n\n1. Do not forward island props into `\u003ccomponent :is\u003e`, `resolveDynamicComponent`, or `h()`. Map an untrusted discriminator through a closed allowlist of imported component definitions instead of passing the raw prop value.\n2. Declare the props an island accepts, or set `inheritAttrs: false` on it, so request input cannot fall through to a polymorphic root component.\n3. Avoid registering sensitive components globally that could leak information if instantiated by an attacker.","status":"published","published":"2026-08-05T21:21:33Z","modified":"2026-08-05T21:41:00.889538Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"CLSA-2026-1788450984","title":"TuxCare security update for nuxt (11 CVEs)","description":"TuxCare rebuilt nuxt to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-09-03T15:56:24Z","modified":"2026-10-15T09:48:03.152914241Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789598338","title":"TuxCare security update for nuxt (7 CVEs)","description":"TuxCare rebuilt nuxt to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-09-16T22:38:58Z","modified":"2026-10-15T09:47:56.237986037Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792161460","title":"TuxCare security update for @nuxt/kit (11 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:37:40Z","modified":"2026-10-16T16:31:03.072757342Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161463","title":"TuxCare security update for @nuxt/kit (7 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:37:43Z","modified":"2026-10-16T16:30:58.380403359Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161485","title":"TuxCare security update for @nuxt/rspack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:38:05Z","modified":"2026-10-16T16:30:59.69839942Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161601","title":"TuxCare security update for @nuxt/schema (11 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:40:01Z","modified":"2026-10-16T16:31:05.866570588Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161604","title":"TuxCare security update for @nuxt/schema (7 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:40:04Z","modified":"2026-10-16T16:31:05.873102631Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161823","title":"TuxCare security update for @nuxt/vite-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:43:43Z","modified":"2026-10-16T16:30:34.584872899Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161826","title":"TuxCare security update for @nuxt/vite-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:43:46Z","modified":"2026-10-16T16:30:32.87761218Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161936","title":"TuxCare security update for @nuxt/webpack-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:45:36Z","modified":"2026-10-16T16:31:30.28168697Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161939","title":"TuxCare security update for @nuxt/webpack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:45:39Z","modified":"2026-10-16T16:31:19.053836641Z","updated_at":"2026-11-02T15:43:51.213191Z"}]}}