{"affected":[{"product":"nuxt","source":"CNA: GitHub_M","vendor":"nuxt","versions":[{"status":"affected","version":">= 3.0.0, < 4.6.4"}]}],"cveId":"CVE-2026-128075","cwes":["CWE-209"],"description":"Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (__NUXT_DATA__) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794591377283,"publishedAt":1794591377283,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-96x6-fvhx-49hg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/commit/8c56b71e4d0377c5c047799078db09c6b3d4fde5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"}],"remediation":[],"revision":"3ae439dff4aec64eb6b9bb7c06a7e1b4dd5dc9eacdc4efcf7ae7b49c04e6972f","sources":[{"modifiedAt":1794591377283,"name":"CNA: GitHub_M","retrievedAt":1794593378357,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128075"}],"ssvc":null,"status":"published","title":"Nuxt exposes the message and data of unhandled errors thrown during server rendering","updatedAt":1794593378357}