Polaris
npmlibrarynuxt

Overview

Canonical component data stored by Polaris.

Version

4.4.6

Package Manager

npm

Type

library

Systems

1

Licenses
MIT
Direct Dependencies

58

Technology

nuxt

External Signals
deps.dev endoflife.date OSV.dev
Package URL

pkg:npm/[email protected]

Maintenance

Derived from available component and registry data

Healthy
Confidence

High

Version Age

80 days

Update Status

Current

Recent Activity

Yes

Reasons
Recent versionMature versionCurrent version

Lifecycle

Source: endoflife.date

Active
Matched Cycle

4

End of Life

—

Active Support Ends

—

LTS

No

Latest Version

4.5.2

Open endoflife.date

Registry

Source: deps.dev

Available
Ecosystem

npm

Latest Version

3.21.11

Published

5/18/2026

Recent Releases

36

Advisories

11

Open deps.dev

Known Vulnerabilities

Source: OSV.dev

11 found

GHSA-48hr-524c-v5w3

Nuxt: Unauthorized Component Instantiation via Server Island Props

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-534h-c3cw-v3h9

Nuxt dev server vite-node IPC socket is world-connectable on Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 4.0.0, before 4.4.7>= 3.18.0, before 3.21.7
Open advisory

GHSA-934w-87qh-qr26

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-9473-5f9j-94wq

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.4.0, before 3.21.10
Open advisory

GHSA-9pgf-384g-p7mv

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-c9cv-mq2m-ppp3

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-hxcr-hm88-mpq6

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
>= 4.0.0, before 4.5.1>= 3.1.0, before 3.21.10
Open advisory

GHSA-m3q2-p4fw-w38m

Cross-site scripting via <NoScript> slot content in Nuxt's head components

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7all versions before 3.21.7
Open advisory

GHSA-mm7m-92g8-7m47

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0, before 4.4.7>= 3.11.0, before 3.21.7
Open advisory

GHSA-rq7w-g337-39qq

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Versions
>= 4.0.0-alpha.1, before 4.4.7
Open advisory

GHSA-wm8w-6qjm-cv43

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Versions
>= 4.4.0, before 4.5.1
Open advisory
Open OSV.dev

Security

Source: OpenSSF Scorecard

Unavailable
No security scorecard available
This component does not have a repository reference for OpenSSF Scorecard lookup.

Dependencies

58 direct dependencies

Global view