Nuxt Icon affected by a Server-Side Request Forgery (SSRF)

Description

nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/_nuxt_icon/[name].

The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure.

Recommendation

Update the @nuxt/icon package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.4.4
• Patched version(s): 1.4.5

References

• GHSA-cxgv-px37-4mp2
• CVE-2024-42352
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Strapi Server-Side Request Forgery (SSRF) - CVE-2024-37818
• pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801
• Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads - CVE-2026-27567
• Server-Side Request Forgery in axios - CVE-2024-39338

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

@nuxt/icon