Summary & Key Takeaways ​

• This is a critical security release for Nuxt v3.21.10.
• It fixes server-side RCE and unauthorized component instantiation via server island props.
• A route rule authorization bypass and server component DoS are also addressed.
• Dev server path disclosure is patched in this release.
• @nuxt/[email protected] also fixes a separate critical development-only RCE.
• Users who upgraded for CVE-2026-53721 still need this release due to a regression fix.
• Various other fixes include clearing hide/reset timeouts and preserving NuxtLink trailing slashes.
• Vite-related SSR and HMR issues are also resolved.

Our Commentary ​

Another Nuxt security release, this time for the v3 branch. It's almost identical to the v4 patch, which tells us these vulnerabilities were pretty fundamental. We're seeing a pattern here that makes me wonder about the underlying architecture's resilience. It's good they're patching quickly, but the sheer volume and severity of these issues are a bit jarring. Developers need to be hyper-vigilant with their Nuxt dependencies right now.