CVE-2025-59414

Executive Summary

CVE-2025-59414 is a client-side path traversal vulnerability in the Nuxt web framework (Vue.js). The flaw resides in the Island payload revival mechanism, where a crafted __nuxt_island object can be injected into a prerendered page. When a client loads the page, the devalue.parse deserialization process triggers a fetch to /__nuxt_island/${key}.json. If the key contains path traversal sequences (e.g., ../), an attacker can manipulate the request to access unintended endpoints within the same application domain. The vulnerability requires specific prerendering conditions and user interaction (navigating to a compromised page). The CVSS score is 3.1 (Low), but the risk increases in environments where prerendered pages are served to authenticated users or contain sensitive data.

Supply Chain & Package Security

Nuxt is distributed via npm (nuxt package). The vulnerability affects all versions prior to 3.19.0 and 4.1.0. Organizations using Nuxt should audit their package.json and lock files to ensure they are not pinned to vulnerable versions. The patch is available in the official Nuxt repository. No known malicious packages exploiting this CVE have been reported, but supply chain hygiene (e.g., verifying package integrity, using npm audit) is recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is initiated over the network.
• Attack Complexity (AC): Low (L) – No special conditions required beyond crafting a malicious payload.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must navigate to a compromised prerendered page.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., internal API responses).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low (CVSS 3.1). However, in scenarios where prerendered pages are cached and served to multiple users, the impact could be amplified.

Deep Dive & Mechanics

The vulnerability is rooted in the client-side payload revival process for Nuxt Islands. During prerendering, Nuxt serializes Island data using devalue.stringify and embeds it in the HTML. The serialized data includes a __nuxt_island object with a key property that determines the endpoint for fetching Island content.

When a client loads the prerendered page, the revive-payload.client.ts script executes devalue.parse on the embedded payload. The Island reviver then constructs a fetch URL: /__nuxt_island/${key}.json. If an attacker can control the key value (e.g., by injecting a crafted __nuxt_island object into the prerendered page via an API endpoint that returns user-controlled data), they can use path traversal sequences like ../ to redirect the fetch to arbitrary endpoints within the same origin.

Example Attack Flow:

1. An attacker identifies an API endpoint that returns user-controlled data and is used during prerendering.
2. The attacker submits a payload containing a __nuxt_island object with a key set to ../../api/admin/sensitive-data.
3. The prerendering process serializes this payload and embeds it in the HTML.
4. When a victim visits the prerendered page, the client-side script fetches /__nuxt_island/../../api/admin/sensitive-data.json, which resolves to /api/admin/sensitive-data.json.
5. The response is processed, potentially leaking sensitive data to the attacker (if the response is reflected or used in the UI).

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 3.19.0 / < 4.1.0):

// revive-payload.client.ts (simplified)
const key = payload.__nuxt_island.key;
const response = await fetch(`/__nuxt_island/${key}.json`);

The key is used directly without sanitization, allowing path traversal.

Patched Code (Nuxt 3.19.0+ / 4.1.0+):

// revive-payload.client.ts (simplified)
const key = payload.__nuxt_island.key;
// Sanitize key to prevent path traversal
const sanitizedKey = key.replace(/\.\.\//g, '').replace(/\.\.\\/g, '');
const response = await fetch(`/__nuxt_island/${sanitizedKey}.json`);

The patch removes ../ and ..\ sequences from the key before constructing the URL.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Nuxt application (version < 3.19.0 or < 4.1.0) with prerendering enabled.
• An API endpoint that returns user-controlled data and is used during prerendering.

Exploitation Steps:

1. Identify a vulnerable API endpoint (e.g., /api/user-input).
2. Craft a payload that includes a __nuxt_island object with a malicious key:

   {
     "__nuxt_island": {
       "key": "../../api/admin/secrets"
     }
   }
   

3. Submit the payload to the API endpoint.
4. Wait for the prerendering process to include the payload in a page.
5. Send the victim a link to the prerendered page.
6. When the victim loads the page, the client-side script fetches /__nuxt_island/../../api/admin/secrets.json, which resolves to /api/admin/secrets.json.
7. The response is processed, and the attacker can observe the data (e.g., via reflected content or network logs).

Proof of Concept (PoC) Script:

import requests

target_url = "http://victim-nuxt-app.com"
api_endpoint = "/api/user-input"
prerendered_page = "/prerendered-page"

# Step 1: Inject malicious payload
payload = {
    "__nuxt_island": {
        "key": "../../api/admin/secrets"
    }
}
requests.post(target_url + api_endpoint, json=payload)

# Step 2: Victim visits prerendered page (simulated)
response = requests.get(target_url + prerendered_page)
print("Prerendered page loaded. Check network logs for fetch to /api/admin/secrets.json")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual fetch requests to /__nuxt_island/ containing path traversal patterns (e.g., ../).
• Alert on API endpoints that return user-controlled data and are used in prerendering.
• Review server logs for requests to /__nuxt_island/ with unexpected keys.

Hardening:

• Apply the patch by upgrading to Nuxt 3.19.0+ or 4.1.0+.
• Sanitize all user-controlled data before it is used in prerendering.
• Implement Content Security Policy (CSP) headers to restrict fetch origins.
• Use Web Application Firewall (WAF) rules to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /__nuxt_island/ containing ../ or ..\\ in the path.
  • Unusual fetch patterns from prerendered pages to internal API endpoints.
• File IOCs:
  • Prerendered HTML files containing __nuxt_island objects with suspicious key values.
• Log IOCs:
  • Server logs showing requests to /__nuxt_island/../../ or similar patterns.
  • Client-side console errors related to failed fetches (e.g., 404 for traversed paths).

Detection Engineering

YARA Rule

rule CVE_2025_59414_Nuxt_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Nuxt Island payload revival"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-59414"
    strings:
        $traversal = /__nuxt_island\/(\.\.\/|\.\.\\)/
    condition:
        $traversal
}

Sigma Rule

title: Nuxt Island Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Nuxt Island endpoints with path traversal sequences
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/__nuxt_island/'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of dots in Island keys (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-59414 Nuxt Island Path Traversal"; flow:to_server,established; content:"/__nuxt_island/"; http_uri; content:"../"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nuxt to version 3.19.0+ or 4.1.0+.
2. If upgrade is not possible, manually sanitize the key parameter in revive-payload.client.ts by removing ../ and ..\\ sequences.
3. Review all API endpoints that return user-controlled data and ensure they are not used in prerendering without sanitization.

Long-term Measures:

• Implement input validation for all user-controlled data used in prerendering.
• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Conduct regular security audits of Nuxt applications.
• Monitor for similar vulnerabilities in the Nuxt ecosystem.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.