Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The Nuxt security policy defines the framework's approach to vulnerability management, secure configuration, and automated security measures. It prioritizes proactive maintenance through dependency management and provides a structured mechanism for reporting security flaws to the maintainers.
The policy encompasses runtime protections, such as Cross-Origin Resource Sharing (CORS) and Content Security Policy (CSP) headers, as well as build-time security measures like OIDC-based trusted publishing for registry interactions.
Sources: SECURITY.md:1-12, packages/schema/src/types/schema.ts:983-997
Vulnerability Reporting and Resolution
Nuxt provides a clear protocol for reporting security vulnerabilities to ensure they are addressed promptly and privately. Contributors and users are encouraged to use GitHub's private reporting feature.
Reporting Channels
- Primary Method: Private report via the Security tab on the specific GitHub repository.
- Alternative Method: Direct email to security@nuxtjs.org if GitHub reporting is unavailable.
Sources: SECURITY.md:3-8
Resolution Workflow
The following diagram illustrates the lifecycle of a security vulnerability report within the Nuxt ecosystem:
The workflow ensures that verification occurs before a fix is implemented and distributed to users.
Sources: SECURITY.md:3-12
Runtime Security Configurations
Nuxt allows developers to configure various runtime security features through the application schema. These settings primarily manage how the application interacts with external resources and handles browser-side security.
Configurable Security Features
| Feature | Configuration Path | Purpose |
|---|---|---|
| CORS | devServer.cors | Configures Cross-Origin Resource Sharing for the development server. |
| Runtime Compiler | vue.runtimeCompiler | Controls if templates can be compiled at runtime (Security risk if untrusted content is passed). |
| CSP | app.head | Allows setting content-security-policy meta tags. |
| HTTP-Equiv | app.head.meta | Supports kebab-case rendering for security headers in meta tags. |
Sources: packages/schema/src/types/schema.ts:153-162, packages/schema/src/types/schema.ts:983-997, test/basic.test.ts:708-712
Runtime Compiler Risks
Enabling vue.runtimeCompiler allows components to compile templates at runtime. However, the documentation warns that runtime-compiled templates can execute arbitrary JavaScript. Developers are instructed never to pass user-provided or untrusted content to these templates.
Sources: packages/schema/src/types/schema.ts:153-162
Build and Release Security
Nuxt employs modern security standards for its own release process, specifically utilizing OpenID Connect (OIDC) for interacting with the npm registry.
Trusted Publishing (OIDC)
The release script implements a two-step OIDC exchange to obtain short-lived tokens from npm, eliminating the need for long-lived secrets in GitHub Actions.
This process ensures that the identity of the GitHub Actions runner is cryptographically verified before granting publishing permissions.
Sources: scripts/release.ts:32-70
Sanitization and Data Protection
The framework includes built-in components and utilities designed to prevent common web vulnerabilities like Cross-Site Scripting (XSS).
Component-Level Protections
- useHeadSafe: A composable that removes dangerous content from head tags before rendering.
- NuxtClientFallback: When rendering fallbacks, Nuxt escapes potential XSS payloads. For example, query parameters containing
<script>tags are entity-encoded (e.g.,<script>) to prevent execution. - JSDoc Escaping: Templates for component metadata include logic to escape comment terminators (
*/to* /) to prevent breaking out of generated documentation blocks.
Sources: test/basic.test.ts:723-725, test/basic.test.ts:503-509, packages/nuxt/test/components-templates.test.ts:88-95
Dependency Maintenance
Nuxt recommends maintaining lock files (yarn.lock, package-lock.json, pnpm-lock.yaml, and bun.lock) to ensure consistent and secure dependency trees. Users are advised to use the latest versions of Nuxt and its dependencies to mitigate risks from discovered vulnerabilities in the supply chain.
Sources: SECURITY.md:10-12
Summary
Nuxt's security policy combines reactive measures (vulnerability reporting) with proactive architectural decisions (OIDC release flows, safe composables, and strict configuration warnings). By enforcing private disclosure and leveraging browser security features like CSP and data encoding, the framework provides a secure-by-default environment for full-stack Vue applications.