CVE-2019-13506: Nuxtjs @nuxt/devalue

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.

Affected products

• Nuxtjs @nuxt/devalue: before 1.2.3 (fixed in 1.2.3)
• Nuxtjs Nuxt.js: before 2.6.2 (fixed in 2.6.2)

Published 2019-07-11. Last modified 2026-06-17.