- Critical security patches fixing server‑side RCE, unauthorized component instantiation, route rule bypass, DoS attacks, cross‑user payload leakage and dev server path disclosure; also upgrades @nuxt/devtools to block a separate developme...
- Numerous bug fixes and performance improvements across Nitro, Vite, Rspack and core Nuxt (lazy FS reads, improved cache handling, CSS extraction fixes, plugin resolution, route tree typing, and more).
- Extensive documentation updates covering dev container setup, SPA fallback pages, payload extraction, NuxtLink details, component directory patterns, security best practices, and other clarifications.
v4.5.1
Official Nuxt changelog summary with source attribution, release tags, and community reactions.
Track this Nuxt release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.
Verify the original release note
Every summary should remain traceable to the original changelog or release source.
Follow this in context
Turn this Nuxt release note into a weekly digest for the tools you actually use.
Create digestMore Nuxt changelog updates
Security release addressing server‑side RCE, unauthorized component instantiation, route rule authorization bypass, DoS, and dev server path disclosure, plus a regression fix from the prior advisory.
Upgrade to Vite 8, Rspack 2 (via Rsbuild) and unhead v3, delivering faster builds and enabling experimental SSR streaming.
Fixed various Vite and Nitro bugs such as SPA entry fallback, CSS extraction, Windows pipe path handling, and atomic prerender cache writes.