Nuxt 4.6.3 Security Fixes, Wrangler 4.153, BullMQ 6.5

Executive Summary

• Nuxt 4.6.3 (Oct 27) lists five security fixes: dev-server file reads, Nitro dev output exposure, the generated app secret, dot-segment paths and redirect route rules on islands. See the v4.6.3 release notes.
• Wrangler 4.153.0 (Oct 26) expands $VAR in --secrets-file, adds --infer-origin-from-routes and bumps Undici and Zod for two advisories. See the release notes.
• BullMQ 6.5.0 (notes), Better Auth 1.7.14 (notes) and Svelte 5.57.3 (notes) are low-risk patch releases from Oct 26.
• Still open if you have not patched: the Oct 21 Node.js security releases (10 CVEs, including a Brotli out-of-bounds write) and the Oct 14 Next.js update (two critical RCEs).

Nuxt 4.6.3: Five Security Fixes

The 4.6.3 patch hardens the dev server: it no longer reads files named in client error reports, blocks access to Nitro dev output and stops serving the generated app secret in development. Nitro and Nuxt now handle dot segments in request paths, and redirect route rules apply to page islands. Nitropack moves to 2.13.5. Performance work skips compiling plain style blocks in the server build and avoids unneeded typed-routes generation.

Behavior fixes worth knowing: useCookie no longer rewrites values on refresh, and navigateTo only returns redirects while middleware runs. Upgrade, especially if a dev server is reachable beyond localhost:

npm install [email protected]
npx nuxt upgrade --dedupe

Cloudflare Wrangler 4.153.0: Secrets File Behavior Change

Per the release notes, deploy, versions upload and preview now expand $VAR and ${VAR} in --secrets-file, with process environment values overriding file keys. An unset reference becomes an empty string, so secrets containing a literal $ need escaping or a JSON secrets file. wrangler dev gains --infer-origin-from-routes, which you can set to false to keep the real localhost origin for CORS and Host checks.

# keep localhost origin instead of rewriting to the route host
npx wrangler dev --infer-origin-from-routes=false

# literal $ in a dotenv secret must now be escaped
API_KEY=pa\$\$word

The release also bumps Undici to 7.30.1 (GHSA-xjj6-f33q-929c, malformed responses crashing dev tools) and Zod to 4.6.6 (GHSA-mrhx-c7xc-m3w5, excessive memory use), makes local kv key list return all keys, and sets the default compatibility date to 2026-10-23.

BullMQ 6.5.0, Better Auth 1.7.14, Svelte 5.57.3

• BullMQ 6.5.0: the only listed change enforces the node: protocol for built-in imports (notes). Check custom bundler or resolver configs.
• Better Auth 1.7.14: TOTP accepts imported Base32 secrets with a base32: prefix, and Kakao sign-in passes loginHint (notes). No security items were listed.
• Svelte 5.57.3: fixes a11y role fallback, derived dependency tracking and redundant attribute writes during hydration (notes).

Carry-Over Security Items

Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including the high-severity Brotli decoder issue CVE-2026-111497 (advisory). Next.js 16.4.1 and 15.5.28 fix critical RCEs in use cache typed arrays and SVG image optimization (CVE-2026-96889), plus a Server Actions denial of service (Next.js advisory).

npm install [email protected]   # current stable; 15.5.28 for the 15.5 line
node --version            # expect v26.12.1, v24.22.1 or v22.23.4

Action Items

1. Upgrade Nuxt to 4.6.3 and rebuild.
2. Audit Wrangler secrets files for literal $ before upgrading CI.
3. Confirm every Node.js runtime and container image is on a patched version, and Next.js is at 15.5.28 or 16.4.1+.