## Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

- 種別: advisory
- 重大度: low
- 関連技術: nodejs, nuxt, vue, github
- CVE: CVE-2026-114130
- 公開日時: 2026-10-22T16:51:37.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-jjm6-p2m9-9w4x)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-jjm6-p2m9-9w4x

影響: npm:nuxt < 4.6.0 → 4.6.0
An application that renders with a value it does not control can be made to render an anchor whose href executes script in the application's origin when clicked. This is an incomplete fix for [GHSA-934w-87qh-qr26](https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26) (CVE-2026-53722). It only affects applications running without a pages/ directory, where pages resolves to false and Nuxt registers its own router in place of vue-router. Applications using vue-router are not affect…