- Security release addressing server‑side RCE, unauthorized component instantiation, route rule authorization bypass, DoS, and dev server path disclosure, plus a regression fix from the prior advisory.
- Extensive bug fixes: cleared timeouts, preserved trailing slashes, fixed SSR CSS module class mismatches, synced layout meta, improved route payload caching, and resolved various SSR and dev tooling issues.
- Documentation updates covering relative baseURL workarounds and security best‑practice warnings for runtime compiler and server component props.
v3.21.10
Official Nuxt changelog summary with source attribution, release tags, and community reactions.
Track this Nuxt release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Nuxt release note into a weekly digest for the tools you actually use.
Create digestMore Nuxt changelog updates
Critical security patches fixing server‑side RCE, unauthorized component instantiation, route rule bypass, DoS attacks, cross‑user payload leakage and dev server path disclosure; also upgrades @nuxt/devtools to block a separate developme...
Upgrade to Vite 8, Rspack 2 (via Rsbuild) and unhead v3, delivering faster builds and enabling experimental SSR streaming.
Fixed various Vite and Nitro bugs such as SPA entry fallback, CSS extraction, Windows pipe path handling, and atomic prerender cache writes.