@NUXT/VITE-SERVER · GHSA-p4h3-4h99-9665 · Package
FIX → 4.6.4
A wildcard redirect route rule in the experimental Vite server builder can turn a crafted request path into a protocol-relative Location header. A visitor following a link to the site can be sent to an origin an attacker chooses.
first public Nov 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only applications that build with the experimental Vite server builder (server: { builder: 'vite' }, introduced in 4.6.0), deploy its server output, and have a wildcard redirect rule whose target starts with ** or /**. Applications on the default Nitro builder, static generation output, SPA builds and Nuxt 3 are not affected.
Not affected if nitro-server-builder, no-wildcard-redirect, spa-build, static-export
Who cares nuxt, self-hosted, vite
nuxt or @nuxt/vite-server resolves to a version at or above 4.6.4 in the lockfile.nuxt.config for and for entries with a target starting with or .Under the experimental Vite server builder (@nuxt/vite-server), a wildcard redirect route rule whose target starts with ** or /** could redirect to another origin. A request path continuing with an extra / or \ after the rule's prefix (or a path that normalises to one, such as /old/x/..//evil.example) produced a protocol-relative Location header.
A wildcard redirect rule copies the rest of the request path onto its target. With this configuration:
export default defineNuxtConfig({
server: { builder: 'vite' },
routeRules: {
: { : },
},
})
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
server: { builder: 'vite' }routeRulesredirect**/**Upgrade to 4.6.4
@nuxt/vite-server 4.6.4 (fixed version; nuxt 4.6.4 depends on it)** (for example '/new/**'), or build with the default Nitro server builder.the server built by nuxt build (.output/server/index.mjs) redirected a request for /old//evil.example or /old/\evil.example to //evil.example, which browsers follow to evil.example. A link to an affected site can therefore send a visitor to an origin chosen by an attacker.
Only applications that meet all of the following are affected:
server: { builder: 'vite' }), which was introduced in 4.6.0. Applications on the default Nitro server builder (@nuxt/nitro-server) do not run this code.nuxt generate) and SPA builds (ssr: false) have no server and are not affected.redirect rule whose target starts with ** or /**, such as '/**' or '/**/x'. Targets with a path before the ** ('/new/**') stay on the same origin.Nuxt 3 does not include the Vite server builder.
Fixed in @nuxt/vite-server 4.6.4, which nuxt 4.6.4 depends on. A run of separators (/, \ or their percent-encoded forms) at the start of the copied path now collapses to a single /, so the target stays on the origin it names.
Upgrade to nuxt 4.6.4. If you cannot upgrade, give wildcard redirect targets a path before the ** (for example '/new/**'), or build with the default Nitro server builder.