---
id: "CVE-2026-114130"
kind: "vulnerability"
aliases: ["CVE-2026-114130", "GHSA-jjm6-p2m9-9w4x"]
title: "Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled"
severity: "low"
cvss: 2.3
epss: 0.003289999905973673
exploited: false
status: "open"
category: "package"
products: [{"name": "nuxt", "fixed": ["4.6.0"], "affected": "< 4.6.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-79", "javascript", "nuxt", "package", "self-hosted"]
not_affected_if: ["no-untrusted-to-binding", "nuxt-4.6.0-or-later", "pages-directory-present", "vue-router-in-use"]
published_at: "2026-10-21T18:17:25+00:00"
first_seen_at: "2026-10-23T19:11:31+00:00"
updated_at: "2026-10-23T21:57:29+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jjm6-p2m9-9w4x", "first_seen_at": "2026-10-23T19:11:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114130", "first_seen_at": "2026-10-23T21:57:29+00:00"}]
---

# Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt's NuxtLink component, when the app runs without a pages/ directory, renders a javascript: URL href that is prefixed with an ASCII control character and slips past the existing protocol check. If an attacker controls the :to value and a victim clicks the link, script runs in the application's origin.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nuxt affected < 4.6.0 fixed 4.6.0

## How to check

Check for a pages/ directory in the project and whether nuxt.config sets pages: false; if neither applies to the app, check whether any <NuxtLink :to> binds untrusted input.
Run npm ls nuxt to see the installed version.

## Fix

Upgrade nuxt to 4.6.0 or later; Nuxt 3 gets no fix (end of life 31 July 2026).
If upgrade is not possible, validate :to values so only paths beginning with a single / are accepted.

## Timeline

- 2026-10-23T19:11:31+00:00 ghsa https://github.com/advisories/GHSA-jjm6-p2m9-9w4x
- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114130

## From the sources

## Impact

An application that renders `<NuxtLink :to="...">` with a value it does not control can be made to render an anchor whose `href` executes script in the application's origin when clicked.

This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a `pages/` directory, where `pages` resolves to `false` and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affected.

Prefixing `javascript:` with an ASCII C0 control character, for example `%01`, meant the value was not recognised as having a protocol. It was classified as an internal route and so never reached the protocol check added in GHSA-934w-87qh-qr26, and the router used for `pages: false` passed it through to the rendered `href` unchanged. Browsers strip the leading control character and run the result as a script URL.

Both `<NuxtLink custom>` and the default anchor are affected, and the `href` is present in the server-rendered HTML.

## Mitigating factors

- The application must have `pages` disabled (no `pages/` directory, or `pages: false`).
- The application must bind untrusted input to `:to`.
- A victim must click the rendered link.

## Affected versions

`nuxt` `<4.6.0`, including all Nuxt 3 releases. Versions before `4.4.7` and `3.21.7` are also affected by GHSA-934w-87qh-qr26.

## Patches

Fixed in `nuxt@4.6.0`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Anchor `href` values are now checked for script-capable protocols wherever they are rendered, including the router used when `pages` is disabled. Protocol detection also moved to the platform `URL` parser, so a URL is classified the same way the browser will read it.

## Workarounds

Upgrade to `nuxt@4.6.0` or later. If you cannot upgrade, including on Nuxt 3, validate values before binding them to `:to`, for example by rejecting anything that is not a path beginning with a single `/`.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_