CVE-2025-59414: Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival

September 17, 2025 (updated September 18, 2025)

A client-side path traversal vulnerability in Nuxt’s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.

References

github.com/advisories/GHSA-p6jq-8vc4-79f6
github.com/nuxt/nuxt
github.com/nuxt/nuxt/commit/2566d2046bccb158d98fb13e42ce4b2c33fb2595
github.com/nuxt/nuxt/security/advisories/GHSA-p6jq-8vc4-79f6
nvd.nist.gov/vuln/detail/CVE-2025-59414

Code Behaviors & Features

Detect and mitigate CVE-2025-59414 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →