Summary & Key Takeaways ​

• This is a critical security release for Nuxt v4.5.1.
• It fixes server-side RCE and unauthorized component instantiation.
• An authorization bypass in route rules and server component DoS are also addressed.
• Cross-user payload disclosure on cached pages and dev server path disclosure are patched.
• @nuxt/[email protected] also fixes a separate critical development-only RCE.
• Users who upgraded for CVE-2026-53721 still need this release due to a regression fix.
• Purge CDN/edge caches if using cache, swr, or isr route rules.
• Performance improvements include replacing island teleports in a single HTML pass.

Our Commentary ​

This is a big one. We've seen a lot of security patches lately, but multiple RCEs, DoS, and data leaks in one go? That's a serious wake-up call for the Nuxt ecosystem. The fact that a previous fix introduced a regression is just... chef's kiss for the chaos. I'm genuinely concerned about the implications for projects that aren't on top of their updates. This isn't just a "patch and forget" situation; it demands immediate attention and cache purging.