CVE-2026-114130: Cross-Site Scripting via ASCII Control Characters in Nuxt Fallback Router

Vulnerability ID: CVE-2026-114130
CVSS Score: 2.3
Published: 2026-10-22

A Cross-Site Scripting (XSS) vulnerability exists in Nuxt when configured with pages disabled (pages: false). ASCII C0 control characters prefixing javascript: URIs bypass internal protocol classification in the fallback router, allowing unauthenticated attackers to execute arbitrary script in the victim's origin context upon user interaction.

TL;DR

Nuxt applications running with pages disabled fail to sanitize javascript: URIs prefixed with ASCII C0 control characters, resulting in reflected/DOM XSS when rendered within NuxtLink components.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network
• CVSS v4.0 Score: 2.3 (Low)
• EPSS Score: 0.00329 (24.75th percentile)
• Impact: Cross-Site Scripting (XSS)
• Exploit Status: poc
• CISA KEV Status: Not Listed

Affected Systems

• Nuxt 4.x applications configured with 'pages: false'
• nuxt: >= 4.0.0, < 4.6.0 (Fixed in: 4.6.0)

Code Analysis

Commit: 355ed95

fix(nuxt): sanitize external href with URL probe base

Commit: df46569

cherry-pick fix for sanitize external href into release branch

Exploit Details

• GitHub Security Advisory GHSA-jjm6-p2m9-9w4x: Proof of concept test cases within official advisory and repository patch commits

Mitigation Strategies

• Upgrade Nuxt framework to version 4.6.0 or higher.
• Validate and sanitize user input before binding values to link properties in templates.
• Implement strong Content Security Policy (CSP) headers prohibiting inline script execution.

Remediation Steps:

1. Check current package dependencies using 'npm list nuxt' or 'pnpm list nuxt'.
2. Inspect 'nuxt.config.ts' for the presence of 'pages: false'.
3. Update the project dependency via 'npm install nuxt@^4.6.0' or 'pnpm update nuxt@^4.6.0'.
4. Rebuild and redeploy the application.

References

• GitHub Security Advisory GHSA-jjm6-p2m9-9w4x
• Nuxt Pull Request #36459
• Fix Commit 355ed9565127ff9b1453deb7160059ed55b3cb85
• Fix Commit df46569d5d3c7a7799de54c328634168fbae70bb
• Nuxt Release v4.6.0
• NVD Entry for CVE-2026-114130

Read the full report for CVE-2026-114130 on our website for more details including interactive diagrams and full exploit analysis.