# What changed in @nuxt/nitro-server

> 11 changes in @nuxt/nitro-server 4 from its official release notes, upgrade guides and advisories: 11 security. Each one cited. Sources checked 2026-11-14. HTML: https://unstale.sh/npm/@nuxt/nitro-server/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @nuxt/nitro-server 4

### Security

- Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file (4.6.4) — [security advisory](https://github.com/advisories/GHSA-MJRQ-CFFV-Q4QC)
- Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes (4.6.4) — [security advisory](https://github.com/advisories/GHSA-R99W-JH2X-3MG9)
- Nuxt dev server arbitrary file read through client error reports (4.6.3) — [security advisory](https://github.com/advisories/GHSA-X287-WCFC-Q46C)
- Nuxt dev server exposes generated appSecret through Vite file serving (4.6.3) — [security advisory](https://github.com/advisories/GHSA-3XF4-9G3C-4H4W)
- Nuxt dev server exposes private runtime config through the Nitro dev bundle (4.6.3) — [security advisory](https://github.com/advisories/GHSA-648H-GW55-M2G7)
- Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes (4.6.3) — [security advisory](https://github.com/advisories/GHSA-9V7C-Q64Q-VV33)
- Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive (4.6.2) — [security advisory](https://github.com/advisories/GHSA-VJH5-4X84-XRQP)
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) (3.21.7, 4.4.7) — [security advisory](https://github.com/advisories/GHSA-X6QJ-4H56-5RJ5)
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-6M52-M754-PW2G)
- Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-G8WJ-3CR3-6W7V)
- Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` (3.21.6, 4.4.6) — [security advisory](https://github.com/advisories/GHSA-HG3F-28RG-4JXJ)