The Nuxt team has released v4.5.1, an urgent security patch addressing critical vulnerabilities. All users are advised to upgrade immediately using npx nuxt upgrade --dedupe. This release fixes a server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Additionally, refreshing your lockfile pulls in @nuxt/[email protected], which fixes a separate critical development-only RCE. If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
Concrete Changes
- Security fixes: Multiple vulnerabilities including server-side RCE, route rule authorization bypass, component DoS, payload disclosure, and path disclosure.
- Performance:
nitro: Replace island teleports in a single html pass(PR #35515) - Enhancement:
nuxt: Add vue.optionsApi and disable it for v5+(PR #35791) - Enhancement:
nuxt: Without pages, skip client plugins that require routing(PR #35794) - Enhancement:
nuxt: Skip payload revival plugin when ssr: false(PR #35782) - Fix:
nitro: Read rspack dev output fs lazily(PR #35795)
Important Upgrade Notes
If you use the cache, swr, or isr route rules, purge any CDN or edge cache after upgrading because a leaked _payload.json may already be cached upstream. For full details, see Nuxt Security Patch Releases and GitHub Security Advisories.
Why This Matters
This release is critical for production deployments, as the patched vulnerabilities could allow attackers to execute arbitrary code on the server, bypass route restrictions, or cause denial of service. Upgrading now ensures your application is protected against these exploits. The performance and enhancement fixes also improve code quality and developer experience.