Nuxt 4.6.4 and Nitropack 2.13.6: Eleven Security Advisories Fixed

• Nuxt 4.6.4 was published on 2026-11-02 and pulls in nitropack 2.13.6.
• Eight advisories are fixed in Nuxt and three in Nitro.
• Production error pages and payloads keep only the message and data of errors created with createError.
• Webpack and rspack dev servers reject unexpected Host headers, and the new devServer.allowedHosts option sets the allowed names.
• The cache, swr and isr route rules cache only GET and HEAD requests.

Nuxt 4.6.4 Security Release Covers Nuxt and Nitro #

The Nuxt v4.6.4 release notes state that the release is a security release and recommend that you upgrade as soon as you can. The Nitro fixes arrive through a dependency bump, listed as "nitro: require nitropack 2.13.6", so an application gets them only when it resolves nitropack 2.13.6.

4.6.4 is a security release. It fixes eight advisories in Nuxt and pulls in nitropack 2.13.6, which fixes three more in Nitro.

Nuxt v4.6.4 release notes

The previous patch, Nuxt v4.6.3, listed five GHSA security entries and a nitropack update to 2.13.5, so 4.6.4 moves the same dependency forward. The 4.6.4 notes do not name advisory identifiers for these eleven fixes, so you cannot match them to your own dependency tree from the notes alone.

Production Error Pages Keep Only createError Details #

When a page fails to render on the server, the error page and the payload carry only message and data of errors you create with createError. Everything else is stripped. The release lists this under its behaviour changes and links it to the fix "nuxt: do not expose details of untrusted thrown errors".

This suggests that a plain thrown Error will no longer expose its details in rendered error output. Any value that must reach the client should be passed through createError, and error pages and server-side error handling should be checked before you rely on other fields.

Webpack and Rspack Dev Servers Now Check the Host Header #

Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already does. If you use a custom hostname or a tunnel, add it to the new devServer.allowedHosts option. The related commits are "schema,nitro,vite: add devServer.allowedHosts" and "nitro,webpack: include hosts the CLI allows after loading the config".

This suggests that the check affects local development setups and does not change production responses, because it sits in the dev middleware. Confirm that every name you open the dev server with appears in the allow list before you debug a request that fails.

Nitropack Route Caching Stores Only GET and HEAD Responses #

The cache, swr and isr route rules now cache only GET and HEAD requests. They also no longer store responses that set a cookie or send Cache-Control: private or no-store.

This suggests that personalised pages, and pages whose headers mark them private, will be rendered for each request rather than served from cache. Review any cache, swr or isr rule that covers routes receiving POST, PUT or other non-GET requests, because their responses are not cached under these rules.

Wildcard Proxy and Redirect Rules Stay Within Their Scope #

Wildcard proxy and redirect rules reject requests whose resolved target would leave the rule's scope. The release also lists "vite-server: resolve wildcard redirect tails from the matched segments", which changes how the wildcard tail is built for redirects.

Review every wildcard proxy or redirect rule whose target is built from path segments. A rule that forwarded whatever its wildcard matched may now return a rejection, so test those rules before you deploy 4.6.4.

Route Rules Match Encoded Slashes Such as /api%2Fadmin #

Route rules now match paths that contain encoded slashes, so /api%2Fadmin is covered by a /api/** rule. The commit is listed as "nitro,nuxt: match route rules for paths with encoded slashes".

Earlier 4.6.x patches touched the same matching code. Nuxt v4.6.2 made server route rules case-insensitive unless routing is sensitive, and Nuxt v4.6.3 encoded page paths before matching route rule keys. Together with the encoded-slash match in 4.6.4, this suggests that a request that previously fell outside an /api/** rule now receives that rule's behaviour. Audit the rules that protect API prefixes.

workspaceDir Widens Only to a Declared Root or Git Repository #

When workspaceDir is not set, Nuxt widens it past rootDir only to an explicit workspace root or the closest git repository. The commit "schema: only widen workspace dir to a declared workspace root" covers the declared-root case.

In a monorepo without a declared workspace root, the directory Nuxt resolves now depends on the closest git repository. This suggests that a project outside a git repository with no declared root keeps its own directory as the workspace.

X-Forwarded-Proto Is Trusted Only When Opted In #

The release lists "nitro: only trust x-forwarded-proto in when opted-in (#36818)". Under this change, the forwarded protocol is trusted only after an opt-in. The release notes do not name the opt-in setting, so check how your deployment sets X-Forwarded-Proto and how your app reads the request scheme after upgrading.

Upgrade Checklist for Nuxt 4.6.4 #

1. Confirm that error output relies on createError for any detail that must reach the client.
2. If you use a webpack or rspack dev server with a custom hostname or tunnel, add it to devServer.allowedHosts.
3. Review cache, swr and isr rules that cover non-GET requests or responses that set cookies or Cache-Control private or no-store.
4. Test wildcard proxy and redirect rules whose targets are built from matched path segments.
5. Review /api/** and other prefix rules against encoded slashes such as /api%2Fadmin.
6. In a monorepo with no workspaceDir set, confirm the directory Nuxt resolves.
7. Confirm how your deployment supplies X-Forwarded-Proto, and whether it needs the opt-in.

Also in this release #

• "nuxt: use unambiguous encoding for island hash" and "nuxt: strip trailing slashes in linear time" are fixes.
• "nitro: keep leading double slash in renderer request path" fixes the renderer request path.
• "nitro: stream the body read through a nuxt/server handler (#36817)" changes how that body is read.
• "nitro,vite: dedupe dev css by module node (#36420)" changes dev CSS handling.

The release lists many more fixes, documentation, chore, test and CI entries; the full list is in the Nuxt v4.6.4 release notes.