# Risk map — nuxt/nuxt

> Canonical page: https://codevetter.com/unpack/nuxt/risk-map

# Risk map — nuxt/nuxt

Scanned commit 3fde4d625cc353e83ac10f6b75db8ca480167be4 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The following items are sensitive source boundaries and explicit limitations, not confirmed vulnerabilities. Executable configuration, remote layers, dependency installation, development HTTP handlers, and request-header forwarding deserve focused review when changed. Hydration serialization and streaming response commitment impose correctness constraints that cross package boundaries. The strongest observed testing limits are configured exclusions, a disabled benchmark job, and a documented development CSS fixme.
- Configuration is executable input: importConfigFile uses native dynamic import and may retry through Jiti, while c12 enables global rc loading by default and accepts remote extends sources. — [packages/kit/src/loader/config.ts#L305-336](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/kit/src/loader/config.ts#L305-L336) [packages/kit/src/loader/config.ts#L355-377](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/kit/src/loader/config.ts#L355-L377)
- Dependency recovery can mutate a consumer project and spawn a package-manager process: ensureDependencyInstalled prompts outside CI, permits StackBlitz-specific auto-install behavior, and runCommand invokes tinyexec with the detected command and arguments. — [packages/kit/src/dependency.ts#L62-94](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/kit/src/dependency.ts#L62-L94) [packages/kit/src/dependency.ts#L134-152](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/kit/src/dependency.ts#L134-L152)
- The Vite builder includes workspaceDir, module directories, layer roots, and discovered component/plugin/middleware/layout directories in its allowDirs calculation, so development file access must be reviewed beyond the application's immediate root. — [packages/vite/src/vite.ts#L61-78](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/vite/src/vite.ts#L61-L78)
- Request-scoped fetch forwards incoming headers, excluding a defined denylist, only when the underlying request is a string beginning with '/'; the wrapper sits below user hooks. useFetch separately rejects protocol-relative requests without baseURL. — [packages/nuxt/src/app/composables/ssr.ts#L52-95](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/app/composables/ssr.ts#L52-L95) [packages/nuxt/src/app/composables/fetch.ts#L710-712](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/app/composables/fetch.ts#L710-L712)
- Public/app runtime config and serializable async-data results reach browser-visible scripts or payload JSON; private values placed into those objects would therefore cross the client boundary. (inferred) — [packages/nuxt/src/app/nuxt.ts#L310-314](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/app/nuxt.ts#L310-L314) [packages/nuxt/src/runtime/server/renderer/payload.ts#L22-45](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/runtime/server/renderer/payload.ts#L22-L45) [packages/nuxt/src/app/composables/asyncData.ts#L983-985](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/app/composables/asyncData.ts#L983-L985)
- deriveSecret fails with status 500 when appSecret is unset or shorter than 32 characters and derives purpose-specific HKDF-SHA256 material; session sealing depends on that derivation unless an explicit password is supplied. — [packages/nuxt/src/server/secret.ts#L23-41](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/server/secret.ts#L23-L41) [packages/nuxt/src/server/session.ts#L235-238](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/server/session.ts#L235-L238)
- Session data is sealed into the cookie and limited to 4096 serialized characters; default HttpOnly, Secure, SameSite=Lax, and root-path settings can be overridden through config.cookie. — [packages/nuxt/src/server/session.ts#L205-221](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/server/session.ts#L205-L221) [packages/nuxt/src/server/session.ts#L241-248](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/server/session.ts#L241-L248)
- getRequestIP trusts the first x-forwarded-for value only when explicitly enabled. Applications using that option for access decisions depend on their proxy's header handling; this is an integration hypothesis, not a demonstrated exploit. (inferred) — [packages/nuxt/src/server/index.ts#L218-226](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nuxt/src/server/index.ts#L218-L226)
- The optional Chrome DevTools workspace endpoint exposes an absolute root and stable UUID, but its implementation requires both a loopback peer and isLocalDevRequest; allowedHosts:true changes the host policy input. — [packages/nitro-server/src/index.ts#L982-1012](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nitro-server/src/index.ts#L982-L1012) [packages/nitro-server/src/index.ts#L1191-1204](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nitro-server/src/index.ts#L1191-L1204)
- Streaming commits response status before delayed page work completes: tests explicitly expect a mid-stream error to retain HTTP 200 and a late 418 to be dropped, while buffered rendering applies the late status. — [test/e2e/ssr-streaming.test.ts#L345-389](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/test/e2e/ssr-streaming.test.ts#L345-L389)
- Compatibility code is an active transition surface: nitroLegacy has independent imports/h3/specifier/runtimeConfig/config toggles, detects migrated Nitro v3 specifiers, and states that the compatibility layer is intended for removal in Nuxt 6. — [packages/nitro-server/src/compat.ts#L22-51](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nitro-server/src/compat.ts#L22-L51) [packages/nitro-server/src/compat.ts#L73-82](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/packages/nitro-server/src/compat.ts#L73-L82)
- Source-recorded verification gaps include disabled benchmark CI, excluded Rspack chunk-error browser tests, excluded mutation suites under Nitro-Vite, and a fixme for dev streaming CSS; these do not establish failures in other configurations. — [.github/workflows/ci.yml#L370-374](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/.github/workflows/ci.yml#L370-L374) [playwright.config.ts#L31-49](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/playwright.config.ts#L31-L49) [test/e2e/ssr-streaming.test.ts#L267-275](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/test/e2e/ssr-streaming.test.ts#L267-L275)
- Privileged pull_request_target workflows warn against adding checkout and currently operate on PR metadata; ecosystem CI additionally checks triage permission and whether the PR repository was pushed after the trigger comment before dispatching a captured SHA. — [.github/workflows/agent-scan.yml#L3-16](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/.github/workflows/agent-scan.yml#L3-L16) [.github/workflows/semantic-pull-requests.yml#L3-19](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/.github/workflows/semantic-pull-requests.yml#L3-L19) [.github/workflows/ecosystem-ci-trigger.yml#L23-51](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/.github/workflows/ecosystem-ci-trigger.yml#L23-L51) [.github/workflows/ecosystem-ci-trigger.yml#L65-100](https://github.com/nuxt/nuxt/blob/3fde4d625cc353e83ac10f6b75db8ca480167be4/.github/workflows/ecosystem-ci-trigger.yml#L65-L100)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)