chore(deps): update dependency @nuxt/ui to v4 [security]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@nuxt/ui (source)	^2.22.3 → ^4.0.0

---

@​nuxt/ui: UAuthForm / UForm SSR markup omits method, leaking credentials via GET if submitted before hydration

GHSA-gj2h-2fpw-fhv9

More information

Details

Summary

UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password">, serialised into the query string.

Details

src/runtime/components/Form.vue (around the template's <form> element) emits:

<component
  :is="parentBus ? 'div' : 'form'"
  :id="formId"
  ref="formRef"
  :class="ui({ class: [uiProp?.base, props.class] })"
  @submit.prevent="onSubmitWrapper"
>

No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape.

The SSR snapshot of UAuthForm (test/components/__snapshots__/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password"> inside a <form> that has no method.

Proof of concept

Reported by @​nimonian:

1. Create a minimal Nuxt app with a UAuthForm.
2. Build for production and visit in a browser with network throttling at 4G or slower.
3. Enter credentials.
4. Submit (or let autofill + Enter fire before hydration).

The URL becomes /login?email=…&password=…. Reproducible deterministically in Playwright by triggering submit immediately on load.

Impact

Any application using UAuthForm (or UForm with credential-shaped fields) as documented. The cleartext password lands in:

• the address bar,
• window.history,
• the Referer header of every same-origin subresource fetched from the resulting URL,
• access logs of any reverse proxy, CDN, or WAF that records request URLs.

Patch

Default the rendered <form> to method="post" so the pre-hydration fallback submits as POST rather than GET. Vue's @submit.prevent still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing method="get".

Credit

Reported by @​nimonian. Originally filed as GHSA-92g7-2fpq-hmq8 against nuxt/nuxt; moved here because the affected code lives in @nuxt/ui.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/nuxt/ui/security/advisories/GHSA-gj2h-2fpw-fhv9
• https://github.com/nuxt/ui/pull/6512
• https://github.com/nuxt/ui/releases/tag/v4.8.1
• https://github.com/advisories/GHSA-gj2h-2fpw-fhv9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

nuxt/ui (@​nuxt/ui)

v4.8.1

Compare Source

Bug Fixes

• ContentSearch/DashboardSearch: proxy missing CommandPalette props (#​6505) (631f5dc)
• Form: add method="post" to prevent credential leaking via GET before hydration (#​6512) (7a0825a)
• Icon: avoid recursive icon resolution (#​6495) (d50c121)
• locale: improve Thai translation accuracy and consistency (#​6509) (5d82418)
• module: expose component theme keys in AppConfig type (#​6520) (ffaf163)
• module: revert tagPriority to -2 for inline style tag (2dac778)
• Select/SelectMenu/InputMenu: add fallback for max-height (#​6503) (f4d7cbe)

v4.8.0

Compare Source

⚠ BREAKING CHANGES

• InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474)

Features

• Avatar/AvatarGroup: add color prop (#​6405) (6f2396f)
• Breadcrumb: add color prop (#​6406) (955dac1)
• ChatMessage: add body slot and improve actions alignment (#​6460) (48685b6)
• ChatMessage: add color prop and header slot (#​6407) (c6ce8ca)
• ChatPrompt: add submitOnEnter prop to control Enter behavior (b597f90), closes #​6177
• Checkbox/RadioGroup/Switch: add highlight prop for error ring styling (a0deee4)
• CommandPalette: search and highlight description field (524c34d)
• ContentSearch/DashboardSearch: enable Fuse.js token search by default (ba08220)
• ContentSearch: add async search support via useSearchCollection (#​6432) (a1bef8b)
• DashboardGroup: add storageOptions prop (8f0101b), closes #​6170
• Error: add icon prop and leading slot (e6ea707), closes #​6119
• Separator: add position prop (#​6415) (844660a)
• Theme: override component prop defaults (#​6031) (71c008e)

Bug Fixes

• ChatMessage: add wrap-break-word to content slot (#​6476) (eb468e6)
• CommandPalette: only split tokens in highlight when useTokenSearch is enabled (898fbce)
• CommandPalette: preserve relative order of ignoreFilter groups (e4c1787)
• CommandPalette: re-highlight first item after debounced results render (efd7b8e)
• CommandPalette: update default fuse keys in docs and search components (0d9cc0d)
• components: apply theme.prefix to hardcoded utility classes (f51b1e8)
• components: constrain popper content to available viewport height (007b136), closes #​6449
• ContentSearch: preserve intermediate ancestors in breadcrumb prefix (#​6466) (f639b19)
• ContentToc: apply ui.trigger prop to trigger elements (252b906), closes #​6428
• defineShortcuts: use e.code for alt shortcuts to handle macOS key remapping (231f156), closes #​6444
• FileUpload: pass disabled attribute to button variant (2890c83), closes #​6420
• Form: improve errors type (#​6208) (c1090ab)
• InputMenu/Select/SelectMenu: respect trailing: false over default trailingIcon (#​6457) (65b47ce)
• InputMenu: rename autocomplete prop to mode to free up HTML attribute (#​6474) (2799fa6)
• module: don't require @nuxtjs/mdc when using content option (89f7778)
• module: pass computed ref directly to useHead innerHTML (00b7476)
• module: ship stripped [#build](https://redirect.github.com/nuxt/ui/issues/build)/ui.css fallback for tooling (083c2a9), closes #​5504
• ProseKbd: add default slot and make value optional (f317c7f)
• Textarea: autoresize on mount with pre-filled value (e96a0b6), closes #​5962
• useComponentProps: treat array-typed theme values as ClassValue leaves (cac3860)

v4.7.1

Compare Source

Bug Fixes

• ChatMessage: make actions slot accessible on touch devices (f5a3349)
• Drawer: handle RTL mode (#​6396) (2e3fed2)
• Link: prevent double-prefixing with @nuxtjs/i18n auto-localization (#​6404) (dde09d0)
• ProseImg: close zoom overlay on Escape key (e3cdbc5)
• ProsePrompt: improve responsive (0a5b433)

v4.7.0

Compare Source

Features

• AuthForm: add separator slot (#​6305) (81c7ddb)
• Card: add title and description props (3cf7d75), closes #​6001
• CommandPalette: add group-label slot (#​6329) (7fc773c)
• CommandPalette: add searchDelay prop (7d2af05)
• EditorSuggestionMenu: expose suggestion matching options (#​6234) (4427824)
• Link: auto-localize internal links when @nuxtjs/i18n is installed (#​5537) (92cfda0)
• Listbox: new component (#​6307) (00c1651)
• ProsePrompt: new component (#​6362) (2451ac6)
• Table: support sticky header/footer in virtualized mode (#​6217) (15d32ce)
• Textarea: expose autoResize method (#​6120) (9c5c0df)

Bug Fixes

• Accordion/Tabs: use item value as stable key to avoid remounts (#​6380) (3cee610)
• Avatar: remove leading-none from fallback (#​6383) (77ce09a)
• ChatMessage/ChatMessages: preserve generic message type in slot scope (#​6391) (20f66db)
• ChatMessages: prevent layout shift caused by indicator during streaming (#​6297) (b7160e2)
• ChatMessages: use MutationObserver for auto-scroll during streaming (#​6357) (47bf3cb)
• ChatPromptSubmit: ignore disabled prop when status is not ready (600a2ca)
• components: resolve defaultVariants in template logic (#​6361) (75b37d0)
• ContentSearch/DashboardSearch: pick shared props from CommandPalette (cdcf2e5)
• ContentSearch: speed up navigation mapping (0faf2c2)
• ContentToc: use links for scrollspy instead of hardcoded h2/h3 (#​6282) (6aba2ea)
• FieldGroup: prevent context from leaking into portals (#​6313) (5155e27)
• FileUpload: use form field color and highlight instead of raw props (bb5a9ed)
• Header/DashboardSidebar/Sidebar: allow auto focus in menu for proper focus trapping (#​6266) (9b91ee4)
• InputDate/InputTime: increase segments width (#​6339) (4ebdb2f)
• InputTags: add missing field group variant (#​6326) (aae5378)
• Link: ensure single-root rendering for v-show and $el resolution (#​6310) (2c4ff35)
• Modal/Slideover: drop empty header wrapper when empty (#​6381) (1082960)
• module: use relative tagPriority for inline style tags (#​6299) (ae693d0)
• PricingTable: align header elements vertically (#​6111) (0daacb0)
• PricingTable: handle RTL mode (#​6382) (ab203db)
• ProseCodeCollapse: match background on overscroll (28c89fe)
• ProseImg: respect markdown width attribute (#​6350) (d4e4ea1)
• ProsePre: get code from DOM if code prop is missing (#​6333) (b808ce4)
• Select: support item-aligned position mode (#​6358) (255807a)

v4.6.1

Compare Source

Bug Fixes

• ai: use part.state for streaming detection and deprecate isReasoningStreaming (d2d7543)
• ChatMessage: hide files slot when no file parts exist (9cddc8e)
• ChatMessages: keep indicator visible until first content arrives (195cce8)
• ChatMessages: reset scroll icon when messages are cleared (#​6239) (4ba3eef)
• ChatPrompt: guard enter during composition (#​6280) (a911ca8)
• DashboardSidebar: always pass collapsed: false in mobile menu slots (957a0f5), closes #​6157
• Modal/Slideover/Drawer: suppress reka ui title and description warnings (3451b8d), closes #​6240
• module: inline defaultVariants and prefix in dev template (314e23b)
• module: transpile reka-ui to prevent injection errors (#​6286) (b822c43)

v4.6.0

Compare Source

⚠ BREAKING CHANGES

• module: use moduleDependencies to manipulate options (#​5384)

Features

• add standalone Vue REPL playground (#​6209) (390c4bd)
• ChatMessage: add files slot (12d6020)
• ChatReasoning: new component (#​6175) (6db594e)
• ChatShimmer: new component (#​6171) (8db9c54)
• ChatTool: new component (#​6176) (7849534)
• Checkbox/Switch: add support for trueValue / falseValue props (#​6150) (91c6356)
• ContentToc: add highlight-variant prop (#​5746) (df080ce)
• DropdownMenu: add filter prop (#​6153) (a529b43)
• FileUpload: add fileImage prop (#​5935) (40f9c2e)
• Icon: add global options on Vue-only side (#​5354) (566fbee)
• InputMenu: add autocomplete prop (#​6026) (ee8a248)
• InputTime: add range prop (#​6203) (c124f29)
• locale: add Icelandic language (#​6149) (f3ddc60)
• module: use moduleDependencies to manipulate options (#​5384) (dd3f5c5)
• Sidebar: new component (#​6038) (51a1f85)
• Table: implement row pinning (#​6115) (fbd60d9)
• Tooltip: support global content configuration via App tooltip prop (#​6152) (83afd9c)
• unplugin: add support for prose components (#​6198) (c58b9b2)

Bug Fixes

• Avatar: use resolved size for image width/height (#​6008) (6dd0fc4)
• ChatShimmer: handle RTL mode (#​6180) (51793a8)
• ContentNavigation: prevent toggling disabled parent items (#​6122) (0f1074f)
• ContentSurround: handle RTL mode (#​6148) (6921f13)
• ContentToc: reset start margin at lg breakpoint (8f24f79)
• DashboardSearchButton: use valid HTML structure for trailing slot (#​6194) (578a12f)
• Editor: guard lift calls for unavailable list extensions (#​6100) (065db6b)
• Error: support status and statusText properties (1350d62), closes #​6134
• FileUpload: make multiple, accept and reset options reactive (#​6204) (ae093df)
• Modal/Slideover/Popover/Drawer: prevent double close:prevent emit (#​6226) (9a0d501)
• module: only auto-import public composables and allow Vite opt-out (#​6197) (886f5fb)
• NavigationMenu: improve RTL support for viewport and indicator (#​6164) (755867b)
• NavigationMenu: propagate disabled state to item in vertical orientation (6d4d651)
• ProsePre: move shiki line highlight styles to theme (d663950)

v4.5.1

Compare Source

Bug Fixes

• components: improve arrow styling with stroke-default and fill-bg (#​6095) (0e9198e)
• components: improve slots return types and tests (#​6109) (7d1e863)
• components: prevent transformUI from mutating cached useComponentUI value (286738a), closes #​6104 #​4387
• ContentToc: add relative positioning to content slot (fcdb231), closes #​6117
• ContentToc: use rem units for indicator size calculation (d631853)
• NavigationMenu: prevent navigation when clicking trailing area in horizontal orientation (8f84c90), closes #​6083
• Page: make slot presence reactive for variant computation (082ea41)
• types: resolve isArrayOfArray type return (#​6097) (04292d9)
• useResizable: use function declaration to prevent false auto-import (c22ecf4)

v4.5.0

Compare Source

Features

• DashboardSidebar/Header: add autoClose prop (#​6089) (2663deb)
• EditorDragHandle: proxy nested / nestedOptions props and emit hover event (#​5960) (ed60193)
• Form: add HTML5 validation to programmatic submit (#​6002) (ed552fc)
• locale: add Belarusian language (#​5972) (ac9e7b3)
• module: add support for taupe / mauve / mist / olive neutral colors (#​6081) (bc49d3f)
• NavigationMenu: allow tooltip usage in horizontal orientation (#​5682) (f46b504)
• NavigationMenu: handle chip in items (#​6064) (401a2c0)
• ScrollArea: add skipMeasurement virtualize option (#​5721) (548b711)
• Select/SelectMenu: add hover effects on outline and subtle variants (94b0c31)
• Theme: new component (#​4387) (c97047d)
• Toaster: prevent duplicate toasts and add pulse animation (3f6581a)

Bug Fixes

• BlogPost/ChangelogVersion: use ImgHTMLAttributes type for image prop (#​6007) (0185856)
• ChatMessages: allow message props to override role defaults (#​6000) (f64ec17)
• ChatMessages: prevent flash at top before scrolling to bottom on mount (4bdcb83)
• Checkbox/Switch: prevent data-state conflict when used inside Tooltip (2bb1a8b), closes #​3599
• CheckboxGroup: update update:modelValue emit type (#​5927) (64d2e88)
• ColorModeImage: add baseURL support for public paths (#​6006) (db510f3)
• components: add fixed prop to prevent responsive text size reduction (#​6074) (8f5f44c)
• components: nullable and optional type support (#​6060) (cd3432b)
• components: prevent iOS auto-zoom on input fields with font-size below 16px (#​6040) (1262016)
• ContentNavigation: pass nested child data to slots (#​6043) (e67f77e)
• defineShortcuts: add alt key guard (#​6020) (8451f45)
• defineShortcuts: allow shifted special character shortcuts (08facc0)
• Drawer/Modal/Popover/Slideover: prevent unexpected close on touch when interacting with other overlays (#​5695) (e2c038c)
• Editor: handle placeholder in RTL mode (#​5977) (3cc16e3)
• EditorMentionMenu: use char prop as mention prefix instead of always @ (0b9b097), closes #​6035
• EditorToolbar: proxy size prop to dropdown menu (8f8d989)
• InputMenu/InputNumber/SelectMenu: proxy size to buttons (1ec1698), closes #​5958
• InputMenu/Select/SelectMenu: exclude cosmetic items from model value type (#​6044) (22cf1ea)
• InputMenu/SelectMenu: sort filtered items by match relevance (058c66b), closes #​4672
• InputMenu: prevent focus on trailing button (88073b6)
• module: update icon cssLayer option from components to base (#​6076) (e8bc322)
• NavigationMenu: allow clicking trailing slot in horizontal orientation (7f9996f), closes #​5192 #​6083
• NavigationMenu: unique auto-generated item values for grouped items (7b317d9)
• PricingPlan: truncate title (#​6041) (8e86c51)
• Select: remove useless by prop (14dceaf)
• Table: improve perfs with shallowRef when watch deep is disabled (#​6023) (bc06ce2)
• Toast: allow update to keep toast open and reset duration (82afa0a)
• Toast: improve animation smoothness (#​6065) (ee2c0a5)
• types: improve DotPathKeys accuracy and GetItemKeys performance (#​6077) (6f7af3e)
• useEditorMenu: rank filtered results by relevance (f53484a)

v4.4.0

Compare Source

Features

• Calendar: add weekNumbers prop (#​4555) (7a1a71b)
• ChangelogVersions: handle scroll options in indicator prop (#​5257) (6a925cd)
• CommandPalette/InputMenu/SelectMenu/Tree: handle virtualizer estimateSize as function (#​5748) (d51b424)
• CommandPalette: add input prop (#​5736) (12052e8)
• CommandPalette: add size prop (#​5878) (3ae04c6)
• components: add by prop (#​5906) (36cd5e5)
• components: add valueKey prop (#​5905) (55646ea)
• Editor: add placeholder.mode prop (d90acb3), closes #​5785
• Editor: add size prop in menus (#​5889) (571d50d)
• Editor: add taskList handler (#​5837) (db04197)
• Editor: add support for code inside links (2ed2d5d)
• Editor: handle boolean in image and mention props (b6fa83a), closes #​5820
• EditorMentionMenu: handle async search with ignoreFilter prop (#​5880) (f8d1883)
• InputMenu/Select/SelectMenu: expose viewportRef for infinite scroll (#​5836) (f4a945c)
• InputMenu/SelectMenu: add clear prop (#​5643) (ec6b8ec)
• Link: support custom navigate function in vue (#​5860) (f51e58a)
• ProseTd/ProseTh: handle align prop (859390e), closes #​5795
• Timeline/Stepper: add wrapper slot and fix dynamic slot conditions (#​5868) (8610d4d)
• Timeline: add select event (#​5826) (8e431be)

Bug Fixes

• Banner: isolate banner visibility using per-instance CSS variables (#​5751) (c7332eb)
• Banner: prevent XSS via id prop injection (4e334a0)
• CommandPalette/ContextMenu/DropdownMenu: keyboard selection on link items (3f5bdb3)
• CommandPalette: prevent XSS in search highlight (e12ceb6)
• ContentSurround: align next link to right on tablet without prev (#​5833) (b3adccc)
• defineShortcuts: check shift modifier for special character shortcuts (bd344d7), closes #​5911
• Editor: set contentType when updating value (c37d6f7), closes #​5709
• Editor: support all heading levels by default (3046c3e)
• EditorToolbar: prevent onClick from being called twice on items (cbed0cc), closes #​5784
• EditorToolbar: prevent disabled dropdown when items have no kind (d473f63)
• Error/Main: render as main instead of div (6ccb1f5)
• FileUpload: emit null when clearing file (#​5892) (1d9a2fd)
• FileUpload: keep input visible when preview is disabled with multiple files (597ac29), closes #​5875
• locale: improve cs and sk terminology for correct inflection (#​5789) (af6f288)
• module: only override primary color and md size default variants (f422de8)
• ProseCodeTree: prevent infinite update loop with expandAll prop (c79cb77), closes #​5828
• useOverlay: refine close event argument extraction (#​5775) (182af20)

v4.3.0

Compare Source

Features

• AuthForm: allow all input types (#​5565) (1f9009f)
• ContextMenu/DropdownMenu: expose sub prop on content slots (#​5609) (b09e6bc)
• defineShortcuts: add layoutIndependent option (#​4251) (ece0568)
• Editor: new component (#​5407) (38765c3)
• extractShortcuts: add separator option (#​5642) (4e71271)
• FormField: add orientation prop (#​5632) (b74ec6e)
• InputMenu/Select/SelectMenu: add modelModifiers prop (#​5559) (a92ee7b)
• locale: add Basque language (#​5689) (748d78f)
• locale: add English (United Kingdom) language (#​5561) (b0139f0)
• locale: add Lao language (#​5556) (f5f9885)
• module: generate [@source](https://redirect.github.com/source) for nuxt layers (#​5630) (de98a72)
• ProseCodeTree: add items prop (cb34ca5)
• ScrollArea: new component (#​5245) (effbb18)
• Slideover: add inset prop (05bd995)
• unplugin: add router option to disable router (#​5213) (b34cf8a)
• unplugin: add scanPackages option (#​5510) (4e57139)

Bug Fixes

• BlogPost/ChangelogVersion/PageFeature/User: allow tab focus (47d93d3), closes #​5635
• Carousel: consistent stopOnInteraction behavior (#​5489) (36a7861)
• Carousel: improve dots focus styles (cc90fb8)
• ColorModeButton: improve icon class merging (2ce9af2)
• ContentSearch/DasboardSearch: set full height on mobile to prevent jump (70317e5)
• DashboardResizeHandle: allow hover over panel with z-index (07147f1)
• EditorDragHandle: add missing UButton import (1b850bb)
• EditorToolbar: map dropdown items recursively to support kind (feb756d)
• FormField: hide error if error prop is false (#​5599) (6b7fe25)
• InputDate/InputTime: add missing field group variant (#​5596) (cb3cec2)
• PageCard/PageCTA/PageSection: handle reverse prop under lg screens (#​5545) (60b430c)
• ProseA/ProseCallout/ProseCard: improve focus styles (df5f8c2)
• Slider: add aria-label to thumb (#​5313) (f99ec46)
• Table: only forward necessary props (#​5527) (b0b209e)
• Table: properly position pinned columns based on size (e885b0e), closes #​4721 #​3927

v4.2.1

Compare Source

Bug Fixes

• ChatPromptSubmit: proxy event to stop and reload emits (#​5400) (736a547)
• ColorModeButton: missing icon import (5f30ccf), closes #​5486
• Icon: improve name type (#​5498) (b654a77)
• Link: define NuxtLinkProps instead of importing from #app (#​5491) (da8daaa)
• Link: ensure consistency across Nuxt, Vue and Inertia (a9ed10d), closes #​5012
• module: put back #build/ui.css alias (#​5499) (d9aadc7)

v4.2.0

Compare Source

⚠ BREAKING CHANGES

• components:

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nuxt.new	Error		Sep 30, 2026 11:55pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​nuxt/​ui@​2.22.3 ⏵ 4.11.2	-1	+2	+3

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report