Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-27 · high
One of the eight advisories was a production RCE that hosting platforms mitigated before Nuxt could disclose it.
Why now: Nuxt disclosed all eight advisories together on July 27, the same day the patched releases shipped.
Nuxt shipped 4.5.1, 3.21.10, and a @nuxt/devtools patch on July 27, closing eight security advisories at once, per Vercel's changelog. One of those eight reaches production: GHSA-9473-5f9j-94wq, a high-severity server-side RCE via server island props. Running server islands in prod? This is the bug that reaches your server.
The most severe bug in the batch, GHSA-279x-mwfv-vcqv, is critical but limited to development environments. GHSA-9473-5f9j-94wq is rated high, one tier down, yet it's the one running in live apps.
The same patch closes a route-rule authorization bypass and a bug that let cached payloads leak across users, per the advisory. Both sound minor alone. In a multi-tenant app, either turns into a data-exposure incident.
Vercel's changelog says the production RCE needed platform-wide mitigations before it went public. Hosts patched their infrastructure ahead of the disclosure, not after it. Same-day patch. Not a next-sprint fix.
Teams that treat this as a routine dependency bump are still exposed. Confirm you're past 3.21.10 or 4.5.1 if server islands are live in your app.
Each link below shares sources, entities, or timing with this story.
Shared entities / Shared topic / Earlier coverage
Both cover July, RCE; overlapping topics (advisory, disclosure); earlier July coverage from 2026-07-11.
Shared entities / Earlier coverage / Tension
Both cover July, RCE; earlier July coverage from 2026-07-24; pushes against this story (against).
Both cover July, Same; earlier July coverage from 2026-07-21; pushes against this story (vs).
Both cover July, Same; earlier July coverage from 2026-07-10; pushes against this story (vs).
Shared entities / Earlier coverage
Both cover July, Same; earlier July coverage from 2026-07-25.
Both cover July, Same; earlier July coverage from 2026-07-25.
Both cover July, Same; earlier July coverage from 2026-07-24.
Both cover July, Same; earlier July coverage from 2026-07-23.