# GHSA-gj2h-2fpw-fhv9: @nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

> SSR forms omit method attribute, causing credentials to leak in URL query strings if submitted before JavaScript hydration completes.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 2 Jul 2026

## What is GHSA-gj2h-2fpw-fhv9?

GHSA-gj2h-2fpw-fhv9 is a vulnerability in @nuxt/ui, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

### Official description

### Summary

`UForm` and `UAuthForm` render a server-side `<form>` element with no `method` and no `action` attribute, relying on a hydrated `@submit.prevent` handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a `GET` to the current URL with every named field, including `<input type="password">`, serialised into the query string.

### Details

`src/runtime/components/Form.vue` (around the template's `<form>` element) emits:

```vue
<component
  :is="parentBus ? 'div' : 'form'"
  :id="formId"
  ref="formRef"
  :class="ui({ class: [uiProp?.base, props.class] })"
  @submit.prevent="onSubmitWrapper"
>
```

No `method`, no `action`. `@submit.prevent` is the only thing stopping native submission, and it only exists after hydration. `UAuthForm` composes `UForm` and inherits the same shape.

The SSR snapshot of `UAuthForm` (`test/components/__snapshots__/AuthForm.spec.ts.snap`) shows the rendered markup, with `<input type="password" name="password">` inside a `<form>` that has no `method`.

### Proof of concept

Reported by @nimonian:

1. Create a minimal Nuxt app with a `UAuthForm`.
2. Build for production and visit in a browser with network throttling at 4G or slower.
3. Enter credentials.
4. Submit (or let autofill + Enter fire before hydration).

The URL becomes `/login?email=…&password=…`. Reproducible deterministically in Playwright by triggering submit immediately on `load`.

### Impact

Any application using `UAuthForm` (or `UForm` with credential-shaped fields) as documented. The cleartext password lands in:

- the address bar,
- `window.history`,
- the `Referer` header of every same-origin subresource fetched from the resulting URL,
- access logs of any reverse proxy, CDN, or WAF that records request URLs.

### Patch

Default the rendered `<form>` to `method="post"` so the pre-hydration fallback submits as POST rather than GET. Vue's `@submit.prevent` still intercepts the hydrated case; the attribute only matters in the race window. Applications that explicitly want native GET submission can opt back in by passing `method="get"`.

### Credit

Reported by @nimonian. Originally filed as `GHSA-92g7-2fpq-hmq8` against `nuxt/nuxt`; moved here because the affected code lives in `@nuxt/ui`.

## Which versions are affected by GHSA-gj2h-2fpw-fhv9?

2 open source packages ship an affected version, including @nuxt/ui.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `@nuxt/ui` | npm | All versions | 4.8.1 |
| `@nuxt/ui` | npm | All versions | 4.8.1 |

## How do I fix GHSA-gj2h-2fpw-fhv9?

Upgrade @nuxt/ui to 4.8.1 or later.

## Is GHSA-gj2h-2fpw-fhv9 being exploited?

There is no known exploitation of GHSA-gj2h-2fpw-fhv9 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-gj2h-2fpw-fhv9 and fix it if it is affected.

What it is: GHSA-gj2h-2fpw-fhv9 is a vulnerability in @nuxt/ui, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-gj2h-2fpw-fhv9 in the wild and no public exploit code.

Affected packages and fixed versions:
- @nuxt/ui (npm): affected all versions; fixed in 4.8.1
- @nuxt/ui (npm): affected all versions; fixed in 4.8.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/ (Markdown: https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-gj2h-2fpw-fhv9

---
From sbomify Insights: https://insights.sbomify.com/GHSA-gj2h-2fpw-fhv9/
Summaries are generated and may contain mistakes; the official description above is the record.