Polaris
npmlibrarynuxt

Overview

Canonical component data stored by Polaris.

Version

4.3.1

Package Manager

npm

Type

library

Systems

1

Licenses
MIT
Direct Dependencies

59

Technology

nuxt

External Signals
deps.dev endoflife.date OSV.dev
Package URL

pkg:npm/[email protected]

Maintenance

Derived from available component and registry data

Stable
Confidence

High

Version Age

180 days

Update Status

Current

Recent Activity

Yes

Reasons
Moderate ageMature versionCurrent version

Lifecycle

Source: endoflife.date

Active
Matched Cycle

4

End of Life

—

Active Support Ends

—

LTS

No

Latest Version

4.5.2

Open endoflife.date

Registry

Source: deps.dev

Available
Ecosystem

npm

Latest Version

3.21.11

Published

2/7/2026

Recent Releases

36

Advisories

13

Open deps.dev

Known Vulnerabilities

Source: OSV.dev

13 found

GHSA-48hr-524c-v5w3

Nuxt: Unauthorized Component Instantiation via Server Island Props

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-534h-c3cw-v3h9

Nuxt dev server vite-node IPC socket is world-connectable on Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 4.0.0, before 4.4.7>= 3.18.0, before 3.21.7
Open advisory

GHSA-934w-87qh-qr26

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-9473-5f9j-94wq

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.4.0, before 3.21.10
Open advisory

GHSA-9pgf-384g-p7mv

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-c9cv-mq2m-ppp3

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-fx6j-w5w5-h468

Nuxt: Reflected XSS in `navigateTo()` external redirect

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Versions
>= 3.4.3, before 3.21.6>= 4.0.0-alpha.1, before 4.4.6
Open advisory

GHSA-g8wj-3cr3-6w7v

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Versions
>= 3.1.0, before 3.21.6>= 4.0.0-alpha.1, before 4.4.6>= 3.20.0, before 3.21.6 +1 more
Open advisory

GHSA-hg3f-28rg-4jxj

Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected Versions
>= 3.11.0, before 3.21.6>= 3.20.0, before 3.21.6>= 4.2.0, before 4.4.6 +1 more
Open advisory

GHSA-hxcr-hm88-mpq6

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-m3q2-p4fw-w38m

Cross-site scripting via <NoScript> slot content in Nuxt's head components

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-mm7m-92g8-7m47

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7>= 3.11.0, before 3.21.7
Open advisory

GHSA-rq7w-g337-39qq

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0-alpha.1, before 4.4.7
Open advisory
Open OSV.dev

Security

Source: OpenSSF Scorecard

Unavailable
No security scorecard available
This component does not have a repository reference for OpenSSF Scorecard lookup.

Systems (1)

theslopedirect

Dependencies

59 direct dependencies

Global view