CVE-2026-128075

When a page, plugin or route middleware throws an error that is not an HTTP error, Nuxt wraps it with createError before rendering the error page. The wrapped error was treated as one the app raised deliberately, so in production its message and data were sent to the client in the error page payload (NUXT_DATA) and in JSON error responses. For a failed $fetch, that is the URL that was requested (including its query string) and the body of the upstream error response.

An application is affected if server-rendered code lets an error with sensitive details reach the error page, for example:

Anyone who can make the request fail (for example by requesting an id the upstream service rejects) receives [GET] "http://users.internal/users/1?token=...": 502 and the upstream response body. This happens regardless of what a custom error.vue renders, because the details are part of the payload. With the default configuration, the HTTP status line is not affected.