Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
createStreamableHead({ streamKey }) interpolated its streamKey argument directly into the streaming SSR bootstrap and suspense-chunk inline scripts without identifier validation or escaping. If an application forwards untrusted data into that configuration value, the rendered scripts become a script-injection sink. Details streamKey was embedded into JavaScript source via dot notation in two public helpers: createBootstrapScript() returned <scriptwindow.${streamKey}={...}</script renderSSRHeadSuspenseChunk() returned window.${streamKey}.push(...) No escaping, quoting, or identifier validation was applied before these strings were embedded into HTML. A streamKey such as unhead;globalThis.PWNED=1;// broke out of the intended property access and injected arbitrary JavaScript into the page. The JSON escaping used for streamed head entries did not protect streamKey because streamKey was inserted as raw code rather than as serialized data. Impact streamKey is a developer-chosen…
Recommended action: Upgrade to 3.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
##EVIDENCE <img width="1900" height="855" alt="Screenshot2026-03-25090729" src="https://github.com/user-attachments/assets/3da93464-1caf-46ca-818f-46f8fe32ab50" / <img width="1919" height="947" alt="Screenshot2026-03-25090715" src="https://github.com/user-attachments/assets/b27b1fc3-fa89-4864-99c9-4e6cff9a4e40" / <img width="1918" height="925" alt="Screenshot2026-03-25090759" src="https://github.com/user-attachments/assets/9b8c94fa-d4f7-412e-ba14-214bc4103f4c" / <img width="1912" height="812" alt="Screenshot2026-03-25090824" src="https://github.com/user-attachments/assets/3a4e1002-8811-453a-b08c-dfd1e42ebcf0" / <img width="1846" height="409" alt="Screenshot2026-03-22090617" src="https://github.com/user-attachments/assets/9a595e13-ed18-464a-9d1a-0bb71dec96c9" / | Disclosed to Vercel H1 | 2026-03-22 (no response after 12 days) | | Cross-reported here | 2026-04-03 | --- Summary useHeadSafe() is the composable that Nuxt's own documentation explicitly recommends for rendering…
Recommended action: Upgrade to 2.1.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The link.href check in makeTagSafe (safe.ts, line 68-71) uses String.includes(), which is case-sensitive: Browsers treat URI schemes case-insensitively. DATA:text/css,... is the same as data:text/css,... to the browser, but 'DATA:...'.includes('data:') returns false. PoC SSR output: The browser loads this as a CSS stylesheet. An attacker can inject arbitrary CSS for UI redressing or data exfiltration via CSS attribute selectors with background-image callbacks. Any case variation works: DATA:, Data:, dAtA:, JAVASCRIPT:, etc. Suggested fix
Recommended action: Upgrade to 2.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
useHeadSafe() can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered <head tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. Details XSS via data- attribute name injection The acceptDataAttrs function (safe.ts, line 16-20) allows any property key starting with data- through to the final HTML. It only checks the prefix, not whether the key contains spaces or other characters that break HTML attribute parsing. This result gets merged into every tag's props at line 114: Then propsToString (propsToString.ts, line 26) interpolates property keys directly into the HTML string with no sanitization: A space in the key breaks out of the attribute name. Everything after the space becomes separate HTML attributes. PoC The most practical vector uses a link tag. <link rel="stylesheet" fires onload once the stylesheet loads, giving reliable script execution: SSR output: The browser parses…
Recommended action: Upgrade to 2.1.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.