unstale

npm / @nuxt/schema

@nuxt/schema

What changed in @nuxt/schema 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-27.

5 security

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.8 on npm

@nuxt/schema 45 changes

Security 5

  • Nuxt: Server-side route rules (redirect, headers, proxy, ssr) are skipped for case-variant paths when routing is case-insensitive

    4.6.2security advisory

  • @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

    3.21.7, 4.4.7security advisory

  • Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

    3.21.6, 4.4.6security advisory

  • Nuxt: __nuxt_island endpoint does not bind responses to request props, enabling shared-cache poisoning

    3.21.6, 4.4.6security advisory

  • Nuxt's route middleware is not enforced when rendering .server.vue pages via /__nuxt_island/page_*

    3.21.6, 4.4.6security advisory