nuxt
nuxt (latest known version: 4.5.0) has 233 known breaking changes on record, each backed by a source URL.
Security advisories
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
Nuxt: Reflected XSS in `navigateTo()` external redirect
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
Nuxt allows DOS via cache poisoning with payload rendering response
Cross-site scripting via <NoScript> slot content in Nuxt's head components
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
Nuxt vulnerable to remote code execution via the browser when running the test locally
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR
Recent changes
Upgraded to Vite 8 major version which should be reviewed for security improvements
Auto-imported $fetch in user code, fixing edge cases with top-level $fetch.create under Rolldown's output format
Shared file watcher optimization allows Nuxt to piggy-back on Vite's chokidar watcher via experimental.watcher: 'builder'
Added Golar support for type-checking as alternative to vue-tsc, auto-detected or forcible via --checker flag
Added type-check onboarding to nuxt typecheck command with automatic vue-tsc and typescript installation
Added non-interactive nuxt init support for scripting and CI with automatic template package manager detection
Introduced named layout slots runtime feature (experimental typescriptPlugin with dxup) allowing pages to inject content into layout slots
Migrated to unctx v3 to resolve async context issues and improve composable-context reliability
Migrated to unhead v3 with smaller size, synchronous engine, and better type-safety for useHead
Added diagnostics-channel tracing support for server-side SSR subsystems (nuxt.render, nuxt.island, nuxt.data, nuxt.plugin channels)
Made resolved Nuxt environment name available at runtime as import.meta.envName for Vite and webpack/Rspack builds
Added experimental prefetchPreloadTags to forward destination's preload hints during prefetch, downgraded to rel="prefetch"
Exposed prefetch control props in NuxtLink custom slot (prefetch, prefetched, shouldPrefetch)
Added enabled option to useFetch and useAsyncData to gate data fetching with reactive control
Introduced named views support via filename convention (name@view.vue) for pages rendering to multiple NuxtPage outlets
Added useLayout composable for reading the resolved layout for the current route
Implemented stable error code system for build and runtime warnings/errors with codes like NUXT_E1001 and linked documentation
Added experimental SSR streaming mode to dramatically improve Time to First Byte by flushing HTML shell immediately and streaming body as Vue renders
Upgraded to Rspack 2 and rebuilt the builder on top of @rsbuild/core, with dev server now running in middleware mode via Rsbuild
Upgraded to Vite 8 with faster cold starts and latest Rolldown-powered internals
Rspack builder internals now use Rsbuild-based foundation, requiring review of custom Rspack config
Review custom Rspack configuration against Rsbuild compatibility
unhead v3 introduces type-narrowing for useHead which can be a breaking type change from looser v2 types; promise input is no longer supported
Update code to handle stricter useHead typing from unhead v3; check upgrade guide for details
Check what changed for nuxt since your installed version, live.
Open the playground →