CVE-2025-59414: Path Traversal in Nuxt

The path traversal vulnerability resides in Nuxt's Island payload revival mechanism. During prerendering, if an API endpoint returns user-controlled data containing a serialized _nuxtisland object, the vulnerability can be triggered. An attacker could craft malicious data to manipulate the client-side request path, allowing them to access files or resources outside of the intended scope. This could lead to information disclosure, unauthorized access to sensitive data, or even potential code execution depending on the application's configuration and the resources accessible through the traversal. The impact is primarily limited to the client-side and within the same application domain, reducing the overall blast radius.

1. Reserved2025-09-15
2. Published2025-09-17
3. Modified2025-09-18
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59414 is to upgrade to Nuxt version 3.19.0 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing stricter input validation on API endpoints that return serialized _nuxtisland objects to prevent the injection of malicious path components. Additionally, review and harden access controls to sensitive resources to limit the potential impact of a successful traversal. There are no specific WAF rules or detection signatures readily available, so proactive input validation is crucial.