Socket: Free Certified Patches for Nuxt Security Vulnerabilities

What it is

Socket's post on the coordinated Nuxt security release: Nuxt 4.5.1 and 3.21.10 and @nuxt/devtools 3.3.1, covering eight GitHub Security Advisories. Socket has published free Certified Patches for the two most severe production issues (GHSA-9473-5f9j-94wq and GHSA-48hr-524c-v5w3) and says patches for the remaining advisories are in progress, to be later merged into a single consolidated patch.

Preconditions / Affected

• The server-side RCE (GHSA-9473-5f9j-94wq) requires vue.runtimeCompiler enabled (off by default) and an app pattern where attacker-controlled server-island props reach Vue's dynamic component resolution.
• The DevTools RCE affects development environments only, not production. Reachable by another process on the host, by users on the local network when the dev server runs with --host, or by a malicious site visited while the dev server is running.
• The cross-user cached payload disclosure affects Nuxt 4.x authenticated pages using cache, swr, or isr route rules.
• The route-rule authorization bypass triggers when appMiddleware is used with route rules whose keys contain uppercase characters.

What to do

Primary fix — upgrade, and refresh the lockfile so it resolves @nuxt/devtools@3.3.1 or later:

npx nuxt upgrade --dedupe

Where an immediate upgrade isn't practical, apply the free Certified Patches:

socket patch add GHSA-9473-5f9j-94wq
socket patch add GHSA-48hr-524c-v5w3

The page also flags an operational step the summary omits: teams with authenticated pages using cache, swr, or isr route rules must purge CDN and edge caches after upgrading — previously cached _payload.json responses remain served until explicitly evicted, so the upgrade alone does not close the disclosure. Additionally, check transitive dependencies for affected versions, and audit server-island components that pass untrusted props into dynamic/polymorphic Vue components.

Caveats

• Certified Patches apply a minimal reviewed change to the vulnerable version while preserving other behavior — a stopgap, not equivalent to the full upgrade. As of this post only two of the eight advisories have patches published; the rest are pending.
• GHSA-48hr-524c-v5w3 does not enable code execution — it allows unauthorized instantiation of HTML elements or globally registered components, relevant mainly to apps using polymorphic component patterns or Vue attribute fallthrough.
• The RCE's non-default precondition (vue.runtimeCompiler) means many deployments are not exploitable via that path, but the cache-purge and route-rule issues do not carry the same gating.