Nuxt v3.21.10 Security Release: Critical Patches for RCE, Authorization Bypass, and More

Nuxt / Vue · 27 Jul 2026 · 2 min read
#nuxt

Nuxt has released v3.21.10, a security release that all users should upgrade to immediately using npx nuxt upgrade --dedupe. This patch addresses several critical vulnerabilities discovered in server-side rendering and component handling:

  • Server-Side RCE & Unauthorized Component Instantiation: Fixed via server island props validation, preventing remote code execution and unauthorized component creation.
  • Route Rule Authorization Bypass: Corrects a flaw that could allow unauthorized access to protected routes.
  • Server Component DoS: Mitigates a denial-of-service vector targeting server components.
  • Dev Server Path Disclosure: Prevents sensitive path information leakage during development.

Additionally, updating your lockfile pulls in @nuxt/[email protected], which fixes a separate critical development-only RCE vulnerability. If you previously upgraded for advisory CVE-2026-53721, this release is still necessary as it fixes a regression introduced by that earlier fix.

Bug Fixes

  • nuxt: Clear hide/reset timeouts in set() to prevent stale UI state (#35534)
  • nuxt: Preserve trailing slash in NuxtLink href when unset is used (#35501)
  • vite: Resolve SSR inlined CSS module class name mismatch to avoid hydration issues (#35610)
  • nuxt: Sync layout meta during middleware on SSR for consistent layout metadata (#35633)
  • nuxt: Update client URL to match SSR on fatal middleware error, avoiding navigation mismatches (#35637)
  • nuxt: Watch external component directories in development for hot-reload support (#35652)
  • nuxt: Prevent cross-pollution of useAsyncData cache when reactive keys change (#35656)
  • nuxt: Return global route for useRoute in middleware contexts, fixing route resolution (#35652)

Why This Matters

Security vulnerabilities in server-side rendering can have severe consequences, including full server compromise. This release closes multiple high-severity holes, making it essential for any Nuxt application exposed to user input or running in production. The bug fixes also improve reliability in SSR hydration, cache behavior, and development workflows. Upgrading immediately is strongly recommended to protect your application and users.

Source: https://github.com/nuxt/nuxt/releases/tag/v3.21.10

Related

auto-curated · source linked above ← all news