Nuxt.js 4.5.1

Nuxt 4.5.1 dropped today, and the release notes open with a warning symbol for good reason. This isn't a feature drop — it's a security release, and the team is urging everyone to upgrade as soon as possible.

Let's be real for a second: whenever you see "security release" in the patch notes, your first instinct should be to check whether your project is affected, not to celebrate new toys. I've looked through the advisory details so you don't have to play catch-up later.

What's Actually Critical Here

The headline fix addresses a server-side Remote Code Execution (RCE) vulnerability. That's as serious as it gets for a production Nuxt app — an attacker who can craft malicious server island props could theoretically execute arbitrary code on your server. The second fix closes an unauthorized component instantiation vector through the same server island mechanism.

If you deployed any of the recent Nuxt 4.5.x updates that included server island features, your exposure depends on whether you're passing user-controlled data into island props. The CVE assigned to the earlier advisory (CVE-2026-53721) covered route rule injection; this release addresses a regression that the previous fix introduced.

The DevTools Angle

There's a separate but related fix in @nuxt/devtools 3.3.1 — a critical development-only RCE. The key word there is "development-only," meaning it shouldn't affect production deployments. That said, if you're running a local dev server exposed on a network (which you probably shouldn't be), patch accordingly.

Upgrade Path: Simple but Mandatory

Upgrading is straightforward: npx nuxt upgrade --dedupe will pull in the patched dependencies and refresh your lockfile. The lockfile refresh is important because it also pulls in the updated @nuxt/devtools version. Don't skip the --dedupe flag — the regression fix depends on having a clean dependency resolution.

The upgrade is painless. There are no breaking changes, no config migrations, and no API deprecations in this release. That's the silver lining of a security patch — you get the fixes without having to refactor anything.

The Bottom Line

Nuxt 4.5.1 is a must-update for anyone running a Nuxt 4 application in production. The RCE vector is real, the fix is clean, and the upgrade takes five minutes. Run the upgrade command, run your test suite, and deploy. There's no reason to wait.

If you haven't upgraded from Nuxt 3 yet, this is also a good reminder that the 3.x line is approaching end-of-life. The 3.21.10 patch released alongside 4.5.1 will be one of the last maintenance releases for the v3 branch.