@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
- Severity:
- Medium
Description
UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.
Recommendation
Update the @nuxt/ui package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.8.1
- Patched version(s): 4.8.1
References
Related Issues
- Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902
- Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
- Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry - Vulnerability
- RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
You might also like:
- Tags:
- npm
- @nuxt/ui
Anything's wrong? Let us know Last updated on August 04, 2026