Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Nuxt bug bounty programs

nuxt.com Updated

Nuxt runs one public program: a Sorona bug bounty paying up to $6,000.

Top reward
$6,000
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Nuxt runs.

  • Nuxt

    Sorona · Bug bounty

    Open

    Top reward

    $6,000
    Critical
    –
    High
    $6,000
    Medium
    $1,250
    Low
    $625
    Safe harbor
    Partial
    First response
    24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 6 excluded.

  • https://nuxt.com

    Web

  • Nuxt's server-side file handling, asset resolution and the routes it mounts on the Nitro server it ships with

    Products and areas

  • Router and navigation handling, including navigateTo, reloadNuxtApp, route middleware and the URL parsing sitting behind all three

    Products and areas

  • Runtime config and the boundary meant to keep private configuration out of the client bundle

    Products and areas

  • Server-side rendering and payload handling: the serialized payload sent to the client, hydration, and the state values that cross from server to client

    Products and areas

  • The module, plugin and layer system, along with nuxt.config handling and the way third-party modules get loaded into a build

    Products and areas

  • The nuxt/nuxt repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, so framework code across the project is the target

    Products and areas

  • The runtime components that ship enabled in production, NuxtLink, NuxtPage, NuxtLayout, server components and islands among them, and every prop each of those renders into the DOM

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Cloud-provider and deployment-specific issues, which belong to Vercel's main platform program rather than the open-source one

  • Issues that require the developer to already be rendering unsanitized input into a template, which is an application bug rather than a framework bug

  • Nuxt DevTools, which is a development-only surface and not a production target

  • Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity

  • Third-party dependency CVEs without a demonstrated end-to-end chain through Nuxt itself

  • XSS in experimental components that only exists once the developer sets an opt-in config flag the documentation already documents as unsafe

Recent changes

Reward and scope changes across every Nuxt program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Nuxt products, from the NVD.

Search NVD
  • CVE-2026-56301 Medium

    Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the S

  • CVE-2026-56697 Medium

    Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.

  • CVE-2026-56698 Medium

    Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin when user-controlled input is passed to navigateTo.

  • CVE-2026-56326 Medium

    Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and

  • CVE-2026-56317 Low

    Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.

  • CVE-2026-53721 High

    Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.

  • CVE-2026-53722 Medium

    Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying <a> element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to <NuxtLink :to> or :href, t

  • CVE-2026-49993 Medium

    Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the devel

About this page

This page gathers every public program listed under nuxt.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.