nuxi vulnerabilities (TuxCare)
11 vulnerabilities.
-
nuxiTuxCare Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive 6.3 Medium -
nuxiTuxCare Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation 7.5 High -
nuxiTuxCare Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering 7.5 High -
nuxiTuxCare Nuxt - Cross-Site Scripting via NoScript Component Slot Content 2.3 Low -
nuxiTuxCare Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL 5.1 Medium -
nuxiTuxCare @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) 5.9 Medium -
nuxiTuxCare Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning 2.3 Low -
nuxiTuxCare Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) 5.9 Medium -
nuxiTuxCare Nuxt allows DOS via cache poisoning with payload rendering response 7.5 High -
nuxiTuxCare Opening a malicious website while running a Nuxt dev server could allow read-only access to code 5.3 Medium -
nuxiTuxCare Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt 6.3 Medium