Nuxt

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Tier 1 asset) │ $10,000 │ $11,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $500 │ $625 Submit a vulnerability CVE history 10 Last 12 months 14 Lifetime XSS 40 % Access control 20 % Info disclosure 20 % Denial of service 10 % Latest advisories Loading the feed Overview Nuxt is the standard production framework for Vue, the second-largest front-end ecosystem. It is downloaded on the order of a million times a week and is heavily used across European and Asian commercial web estates, where Vue adoption is highest. Because Nuxt ships both a build layer and a server runtime in Nitro, a single Nuxt defect reaches the generated client bundle and the deployed server at the same time, which is why a URL-protocol or template-injection bug here rarely stays cosmetic. Vercel pays it as a Tier 1 asset on its open-source program, from $500 for a low finding up to $10,000 for a critical, and sorona.xyz adds 1.25× on top of whatever Vercel awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 1 business day First response 7 business days Triage 10 business days after triage Bounty In scope The nuxt/nuxt repository itself, listed under Tier 1 (High Priority) as a source-code asset that is bounty-eligible up to critical severity. The asset is the repo, so framework code across the project is the target The runtime components that ship enabled in production, NuxtLink , NuxtPage , NuxtLayout , server components and islands among them, and every prop each of those renders into the DOM Router and navigation handling, including navigateTo , reloadNuxtApp , route middleware and the URL parsing sitting behind all three Server-side rendering and payload handling: the serialized payload sent to the client, hydration, and the state values that cross from server to client Runtime config and the boundary meant to keep private configuration out of the client bundle Nuxt's server-side file handling, asset resolution and the routes it mounts on the Nitro server it ships with The module, plugin and layer system, along with nuxt.config handling and the way third-party modules get loaded into a build Out of scope Nuxt DevTools, which is a development-only surface and not a production target XSS in experimental components that only exists once the developer sets an opt-in config flag the documentation already documents as unsafe Cloud-provider and deployment-specific issues, which belong to Vercel's main platform program rather than the open-source one Issues that require the developer to already be rendering unsanitized input into a template, which is an application bug rather than a framework bug Third-party dependency CVEs without a demonstrated end-to-end chain through Nuxt itself Reports without the mandatory working proof-of-concept zip, which are not eligible regardless of severity Most-valued findings A URL-protocol sanitization gap in NuxtLink or router navigation that fires script from a link the framework accepted, the top class here at 40% of Nuxt's CVE history Template injection into a default-enabled production component, so no unusual configuration is needed for the bug to reach a real site An XSS carried through to session or auth-token exfiltration, which is what moves a finding from Medium into the High and Critical bands Server-side path traversal in file handling that reads something outside the served directory A full RCE chain rooted in a production-enabled component, the shape that reaches the $10,000 Tier 1 critical row Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Include a zip file with working proof-of-concept code, without one the report is not bounty-eligible Nuxt DevTools is a development-only surface and is deprioritised, so a finding there needs a production story to be worth filing Experimental components behind an opt-in flag the docs describe as unsafe are accepted only with a realistic production path Show the bug in framework code rather than in an application that already renders unsanitized input into its own templates Vercel's confidentiality obligations run for two years and survive the end of the program Program stats 100 Reports resolved $241k Bounties paid 89% Response efficiency Disclosure Coordinated through Vercel. Report contents are treated as confidential and Vercel wants written consent before anything is published, so the timing is theirs rather than a fixed clock. sorona.xyz holds your finding until Vercel has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability