nuxt@4.5.0

• 7 known advisories (worst: high), fixed in 4.5.1.Evidence
• 18 issues mention 4.5.0 within 14 days of release (usual for this project: 0.5).Evidence

Confidence 100% · algorithm v1 · computed 2026-10-19. How verdicts work

Malware reports

None known (OSV)

Known advisories

7 known

License

MIT

Install scripts

None

Build provenance

Signed provenance

Weekly downloads

15,452

• moderateGHSA-48hr-524c-v5w3Nuxt: Unauthorized Component Instantiation via Server Island Props
• moderateGHSA-7c4v-fwgw-9rf7Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
• highGHSA-9473-5f9j-94wqNuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
• highGHSA-9pgf-384g-p7mvNuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
• highGHSA-hxcr-hm88-mpq6Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
• highGHSA-hxvh-4h3w-prp9Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
• highGHSA-wm8w-6qjm-cv43Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

No compatibility boundary is crossed: this is a patch or minor release on a stable major.

18 issues mention this version in nuxt/nuxt within 14 days of release. See them on GitHub

Check the official release notes below for behaviour changes before merging.

Read the Nuxt changelog on Changes.Watch or the package page on npm for this version’s features and fixes.

The maintainer has not deprecated this version on npm.