# What changed in @nuxt/kit

> 5 changes in @nuxt/kit 4 from its official release notes, upgrade guides and advisories: 5 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/@nuxt/kit/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nuxt/kit 4

### Security

- Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive (4.6.2) — [security advisory](https://github.com/advisories/GHSA-VJH5-4X84-XRQP)
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) (3.21.7, 4.4.7) — [security advisory](https://github.com/advisories/GHSA-X6QJ-4H56-5RJ5)
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-6M52-M754-PW2G)
- Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-G8WJ-3CR3-6W7V)
- Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-HG3F-28RG-4JXJ)