Nuxt 4.6.4 is a security release: eight Nuxt advisories, three more fixed through Nitro 2.13.6
Victoria Shinder1 min readThe Nuxt team published version 4.6.4 on 2 November and calls it a security release. It fixes eight advisories in Nuxt itself and pulls in nitropack 2.13.6, which fixes three more in Nitro, the server engine Nuxt runs on. The team recommends upgrading as soon as possible.
The release notes flag five behaviour changes that the team says will probably not affect most apps. When a page fails to render on the server, the error page and the payload now carry only the message and data of errors created with createError; everything else is stripped. Webpack and rspack dev servers now reject requests with an unexpected Host header, as Vite already did, so custom hostnames and tunnels must be listed in the new devServer.allowedHosts option. When workspaceDir is not set, Nuxt widens it past rootDir only to an explicit workspace root or the nearest git repository.
The other two concern Nitro route rules. Cache, swr and isr rules now cache only GET and HEAD requests and no longer store responses that set a cookie or send Cache-Control private or no-store; wildcard proxy and redirect rules reject requests whose resolved target would leave the rule's scope. And route rules now match paths with encoded slashes, so a /api/** rule covers /api%2Fadmin. Nitro also now trusts x-forwarded-proto only when that is switched on.
What it means
Most of the fixes close gaps between what a rule was meant to cover and what it actually matched. Apps that rely on a route rule for protection, or on a cache rule for pages that set cookies, should check their behaviour after upgrading, because that is exactly where the release now acts differently.