CVE-2026-56697

Executive Summary

CVE-2026-56697 is a URL redirection vulnerability in the Nuxt framework (versions 4.0.0 before 4.4.7 and 3.x before 3.21.7). The reloadNuxtApp function accepts protocol-relative paths (e.g., //evil.com), which bypasses the script-protocol check but resolves to a cross-origin URL against the current page protocol. An attacker can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing attacks and OAuth authorization-code theft.

Supply Chain & Package Security

This vulnerability affects the Nuxt npm package. Organizations using Nuxt should immediately audit their dependency trees for affected versions. The package is widely used in the JavaScript ecosystem, and the vulnerability can be exploited via user-supplied input or malicious links. Ensure that package.json and lock files are updated to patched versions (4.4.7 or 3.21.7). Additionally, monitor for any suspicious npm packages that may attempt to exploit this vector.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated Medium due to the requirement for user interaction (clicking a link) and the limited impact (redirection). However, in the context of OAuth flows, the impact can be severe, leading to account takeover.

Deep Dive & Mechanics

The reloadNuxtApp function is used to programmatically reload the Nuxt application. It accepts a path parameter that can be a relative URL or a protocol-relative URL (starting with //). The function performs a check to ensure the path does not start with javascript: or other script protocols, but it fails to validate protocol-relative URLs.

When a user visits a page that calls reloadNuxtApp({ path: '//evil.com' }), the browser resolves the URL against the current page's protocol (e.g., https://), resulting in a redirect to https://evil.com. This can be exploited by:

1. Phishing: An attacker crafts a link to a legitimate Nuxt site that triggers the redirect to a malicious login page.
2. OAuth Authorization Code Theft: If the Nuxt site uses OAuth, the attacker can redirect the user after authorization, capturing the authorization code in the URL fragment.

The vulnerability is in the reloadNuxtApp function's path validation logic. The fix involves rejecting any path that starts with // or is an absolute URL.

Vulnerable vs. Patched Code

Vulnerable Code (Nuxt < 4.4.7 / < 3.21.7):

// packages/nuxt/src/app/composables/reload-nuxt-app.ts
export function reloadNuxtApp(options?: ReloadNuxtAppOptions) {
  const path = options?.path || window.location.pathname
  // Only check for script protocols, not protocol-relative
  if (path.startsWith('javascript:')) {
    return
  }
  window.location.href = path
}

Patched Code (Nuxt >= 4.4.7 / >= 3.21.7):

// packages/nuxt/src/app/composables/reload-nuxt-app.ts
export function reloadNuxtApp(options?: ReloadNuxtAppOptions) {
  const path = options?.path || window.location.pathname
  // Reject protocol-relative and absolute URLs
  if (path.startsWith('//') || path.startsWith('http:') || path.startsWith('https:') || path.startsWith('javascript:')) {
    return
  }
  window.location.href = path
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Nuxt application running version 4.0.0 to 4.4.6 or 3.0.0 to 3.21.6.
• Ability to inject a path parameter into reloadNuxtApp (e.g., via a crafted link or XSS).

Exploit Steps:

1. Identify a Nuxt application that uses reloadNuxtApp with user-controlled input.
2. Craft a URL that triggers the vulnerability:

   https://victim.com/some-page?redirect=//evil.com
   

3. If the application passes the redirect parameter to reloadNuxtApp, the user will be redirected to https://evil.com.
4. For OAuth theft, set up a malicious page that mimics the legitimate OAuth flow and captures the authorization code from the URL.

Proof of Concept (PoC):

<!-- Attacker's page -->
<a href="https://victim.com/login?redirect=//evil.com/oauth-callback">Click here to login</a>

Blue Team

Detection:

• Monitor for unusual URL patterns in web logs, especially // at the start of paths.
• Look for reloadNuxtApp calls with suspicious parameters in client-side JavaScript.
• Use the detection rules below to identify exploitation attempts.

Mitigation:

• Immediately upgrade to Nuxt 4.4.7 or 3.21.7.
• If upgrade is not possible, implement a WAF rule to block requests with // in the path parameter.
• Validate and sanitize all user input before passing to reloadNuxtApp.

Indicators of Compromise (IOCs)

• URL Patterns: //evil.com or //attacker-controlled-domain in the path parameter of reloadNuxtApp.
• Network Traffic: HTTP requests to attacker-controlled domains originating from Nuxt applications.
• Log Entries: Web server logs showing redirects to external domains with // prefix.
• Client-Side Artifacts: JavaScript console errors or unexpected redirects in Nuxt applications.

Detection Engineering

YARA Rule

rule CVE_2026_56697_Nuxt_Redirect {
  meta:
    description = "Detects Nuxt reloadNuxtApp calls with protocol-relative paths"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2026-56697"
  strings:
    $reload = "reloadNuxtApp" nocase
    $path = "path:" nocase
    $protocol_relative = /\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/ 
  condition:
    $reload and $path and $protocol_relative
}

Sigma Rule

title: CVE-2026-56697 - Nuxt Protocol-Relative Path Redirection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2026-56697 via URL patterns
author: Valters IT
date: 2025-04-10
logsource:
  category: web
  product: generic
detection:
  selection:
    cs-uri-query|contains: "//"
    cs-uri-query|re: "//[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
  condition: selection
falsepositives:
  - Legitimate use of protocol-relative URLs in other contexts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56697 - Nuxt Protocol-Relative Path Redirection"; flow:to_server; content:"//"; http_uri; pcre:"/\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/R"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nuxt to version 4.4.7 or 3.21.7.
2. If upgrade is not possible, apply a WAF rule to block requests containing // in the path parameter.
3. Review all uses of reloadNuxtApp in the codebase and ensure user input is sanitized.

Long-Term Measures:

• Implement input validation for all URL parameters.
• Use a Content Security Policy (CSP) to restrict allowed redirect destinations.
• Conduct regular security audits of third-party dependencies.

Patch Details:

• Upgrade to Nuxt 4.4.7 or 3.21.7.
• The fix is available in the official Nuxt repository.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert