unstale

npm / @nuxt/nitro-server

@nuxt/nitro-server

What changed in @nuxt/nitro-server 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-11-14.

11 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.3.0 on npm

@nuxt/nitro-server 411 changes

Security 11

  • Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file

    4.6.4security advisory

  • Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading // in the request path bypasses server/middleware path checks and server route rules on page routes

    4.6.4security advisory

  • Nuxt dev server arbitrary file read through client error reports

    4.6.3security advisory

  • Nuxt dev server exposes generated appSecret through Vite file serving

    4.6.3security advisory

  • Nuxt dev server exposes private runtime config through the Nitro dev bundle

    4.6.3security advisory

  • Nuxt: Dot segments in the request path bypass server/middleware path checks and server route rules on page routes

    4.6.3security advisory

  • Nuxt: Server-side route rules (redirect, headers, proxy, ssr) are skipped for case-variant paths when routing is case-insensitive

    4.6.2security advisory

  • @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

    3.21.7, 4.4.7security advisory

  • Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

    3.21.6, 4.4.6security advisory

  • Nuxt: __nuxt_island endpoint does not bind responses to request props, enabling shared-cache poisoning

    3.21.6, 4.4.6security advisory

  • Nuxt's route middleware is not enforced when rendering .server.vue pages via /__nuxt_island/page_*

    3.21.6, 4.4.6security advisory