GHSA-gj2h-2fpw-fhv9

Summary

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Severity

medium

CWE

CWE-200, CWE-598

Published

2026-07-02

Updated

2026-07-02

Advisory details

Summary

UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password">, serialised into the query string.

Details

src/runtime/components/Form.vue (around the template's <form> element) emits:

<component
  :is="parentBus ? 'div' : 'form'"
  :id="formId"
  ref="formRef"
  :class="ui({ class: [uiProp?.base, props.class] })"
  @submit.prevent="onSubmitWrapper"
>

No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape.

The SSR snapshot of UAuthForm (test/components/__snapshots__/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password"> inside a <form> that has no method.

Proof of concept

Reported by @nimonian:

1. Create a minimal Nuxt app with a UAuthForm.
2. Build for production and visit in a browser with network throttling at 4G or slower.
3. Enter credentials.
4. Submit (or let autofill + Enter fire before hydration).

The URL becomes /login?email=…&password=…. Reproducible deterministically in Playwright by triggering submit immediately on load.

Impact

Any application using UAuthForm (or UForm with credential-shaped fields) as documented. The cleartext password lands in:

• the address bar,
• window.history,
• the Referer header of every same-origin subresource fetched from the resulting URL,
• access logs of any reverse proxy, CDN, or WAF that records request URLs.

Patch

Default the rendered <form> to method="post" so the pre-hydration fallback submits as POST rather than GET. Vue's @submit.prevent still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing method="get".

Credit

Reported by @nimonian. Originally filed as GHSA-92g7-2fpq-hmq8 against nuxt/nuxt; moved here because the affected code lives in @nuxt/ui.

References

• https://github.com/advisories/GHSA-gj2h-2fpw-fhv9
• https://github.com/nuxt/ui/security/advisories/GHSA-gj2h-2fpw-fhv9

Related advisories

• CVE-2026-50157 — medium · Packagist/auth0/symfony
• CVE-2026-62988 — critical · Packagist/froxlor/froxlor
• GHSA-m5w8-4gq2-6f8x — critical · npm/vm2
• CVE-2026-64859 — critical · Go/github.com/QuantumNous/new-api
• CVE-2026-70478 — critical · npm/flowise
• CVE-2026-52855 — critical · Go/github.com/pterodactyl/wings
• GHSA-mqhr-6j6h-74p5 — critical · npm/@budibase/server
• GHSA-g936-7jqj-mwv8 — critical · Go/github.com/almeidapaulopt/tsdproxy

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity