GHSA-gj2h-2fpw-fhv9 @nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Not scored Published 2 Jul 2026

SSR forms omit method attribute, causing credentials to leak in URL query strings if submitted before JavaScript hydration completes.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-gj2h-2fpw-fhv9?

GHSA-gj2h-2fpw-fhv9 is a vulnerability in @nuxt/ui, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summary

UForm and UAuthForm render a server-side <form> element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password">, serialised into the query string.

Details

src/runtime/components/Form.vue (around the template's <form> element) emits:

&lt;component
  :is=&#34;parentBus ? &#39;div&#39; : &#39;form&#39;&#34;
  :id=&#34;formId&#34;
  ref=&#34;formRef&#34;
  :class=&#34;ui({ class: [uiProp?.base, props.class] })&#34;
  @submit.prevent=&#34;onSubmitWrapper&#34;
&gt;

No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape.

The SSR snapshot of UAuthForm (test/components/__snapshots__/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password"> inside a <form> that has no method.

Proof of concept

Reported by @nimonian:

Create a minimal Nuxt app with a UAuthForm.
Build for production and visit in a browser with network throttling at 4G or slower.
Enter credentials.
Submit (or let autofill + Enter fire before hydration).

The URL becomes /login?email=…&password=…. Reproducible deterministically in Playwright by triggering submit immediately on load.

Impact

Any application using UAuthForm (or UForm with credential-shaped fields) as documented. The cleartext password lands in:

the address bar,
window.history,
the Referer header of every same-origin subresource fetched from the resulting URL,
access logs of any reverse proxy, CDN, or WAF that records request URLs.

Patch

Default the rendered <form> to method="post" so the pre-hydration fallback submits as POST rather than GET. Vue's @submit.prevent still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing method="get".

Credit

Reported by @nimonian. Originally filed as GHSA-92g7-2fpq-hmq8 against nuxt/nuxt; moved here because the affected code lives in @nuxt/ui.

Which versions are affected by GHSA-gj2h-2fpw-fhv9?

2 open source packages ship an affected version, including @nuxt/ui.

Package	Affected	Fixed in
`@nuxt/ui` npm	All versions	`4.8.1`
`@nuxt/ui` npm	All versions	`4.8.1`

How do I fix GHSA-gj2h-2fpw-fhv9?

Upgrade @nuxt/ui to 4.8.1 or later.

Is GHSA-gj2h-2fpw-fhv9 being exploited?

There is no known exploitation of GHSA-gj2h-2fpw-fhv9 in the wild and no public exploit code.