{"id":386,"date":"2026-07-29T12:22:57","date_gmt":"2026-07-29T12:22:57","guid":{"rendered":"https:\/\/gilnas.synology.me\/wordpress\/386\/"},"modified":"2026-07-29T12:22:57","modified_gmt":"2026-07-29T12:22:57","slug":"nuxt-v4-5-1%c2%b7v3-21-10-%eb%b3%b4%ec%95%88-%ed%8c%a8%ec%b9%98-rce%c2%b7route-rules%c2%b7payload-cache-%eb%8c%80%ec%9d%91-nuxt-security-patch-response-for-rce-route-rules-and-payload-cache","status":"publish","type":"post","link":"https:\/\/gilnas.synology.me\/wordpress\/386\/","title":{"rendered":"Nuxt v4.5.1\u00b7v3.21.10 \ubcf4\uc548 \ud328\uce58: RCE\u00b7Route Rules\u00b7Payload Cache \ub300\uc751 | Nuxt Security Patch Response for RCE, Route Rules, and Payload Cache"},"content":{"rendered":"
\"Nuxt<\/figure>\n

\ud575\uc2ec \ub2f5\ubcc0:<\/strong> Nuxt\ub294 2026\ub144 7\uc6d4 27\uc77c v4.5.1<\/a>\uacfc v3.21.10<\/a>\uc744 \ubcf4\uc548 \ud328\uce58\ub85c \uacf5\uac1c\ud588\ub2e4. \uacf5\uc2dd \ub9b4\ub9ac\uc988 \ub178\ud2b8\ub294 server-side RCE, server island props\ub97c \ud1b5\ud55c \ubb34\ub2e8 \ucef4\ud3ec\ub10c\ud2b8 \uc778\uc2a4\ud134\uc2a4\ud654, route rule authorization bypass, server component DoS, dev server path disclosure\ub97c \uc218\uc815\ud55c\ub2e4\uace0 \ubc1d\ud78c\ub2e4. v4.5.1\uc5d0\ub294 \uce90\uc2dc \ud398\uc774\uc9c0\uc758 cross-user payload disclosure \uc218\uc815\ub3c4 \ud3ec\ud568\ub41c\ub2e4.<\/p>\n

\ub530\ub77c\uc11c Nuxt 3.21.x \ub610\ub294 4.5.x \uc6b4\uc601\uc790\ub294 \ub2e4\uc74c \uc815\uae30 \uc2a4\ud504\ub9b0\ud2b8\uae4c\uc9c0 \uae30\ub2e4\ub9b4 \uc0ac\uc548\uc774 \uc544\ub2c8\ub2e4. \uc758\uc874\uc131 \uc7a0\uae08 \ud30c\uc77c\uc744 \uac31\uc2e0\ud574 \uc9c0\uc815 \ud328\uce58\ub85c \uc62c\ub9ac\uace0, CDN\/edge \uce90\uc2dc\ub97c \uc815\ub9ac\ud558\uace0, server island\u00b7routeRules\u00b7\uac1c\ubc1c \uc11c\ubc84\u00b7DevTools\ub97c \ubd84\ub9ac\ud574 \ud68c\uadc0 \uac80\uc99d<\/strong>\ud574\uc57c \ud55c\ub2e4. \ud2b9\ud788 cache<\/code>, swr<\/code>, isr<\/code> route rule\uc744 \uc4f0\ub294 \uc0ac\uc774\ud2b8\ub294 \uc5c5\uadf8\ub808\uc774\ub4dc \ub4a4\uc5d0\ub3c4 \uc774\uc804 _payload.json<\/code>\uc774 \uc0c1\ub958 \uce90\uc2dc\uc5d0 \ub0a8\uc544 \uc788\uc744 \uc218 \uc788\ub2e4\uace0 Nuxt\uac00 \uacbd\uace0\ud55c\ub2e4.<\/p>\n

\uc624\ub298\uc758 \uacb0\ub860:<\/strong> \uc774\ubc88 Nuxt \ubcf4\uc548 \ub9b4\ub9ac\uc988\ub294 \ud504\ub860\ud2b8\uc5d4\ub4dc \uc758\uc874\uc131 \uc5c5\ub370\uc774\ud2b8\uac00 \uc544\ub2c8\ub77c \uc11c\ubc84 \uacbd\uacc4 \uad50\uc815\uc774\ub2e4. \ubc30\ud3ec \uc18d\ub3c4\ubcf4\ub2e4 \uba3c\uc800 \uacf5\uac1c payload, \uad8c\ud55c \uaddc\uce59, island props, \ub85c\uceec \uac1c\ubc1c \ud3ec\ud2b8\ub97c \uc810\uac80\ud558\ub418, \ubcc0\uacbd \ubc94\uc704\uac00 \ud06c\ubbc0\ub85c canary\uc640 \uba85\ud655\ud55c \ub864\ubc31 \uc870\uac74\uc744 \uac16\ucdb0\uc57c \ud55c\ub2e4.<\/p>\n

\ubb34\uc2a8 \uc77c\uc774 \uc788\uc5c8\ub098<\/h2>\n

2026\ub144 7\uc6d4 27\uc77c, Nuxt \ud300:<\/strong> Nuxt Security Patch Releases<\/a>\uc640 GitHub \ub9b4\ub9ac\uc988\ub85c v4.5.1 \ubc0f v3.21.10\uc744 \ubc1c\ud45c\ud558\uace0 npx nuxt upgrade --dedupe<\/code>\ub97c \uad8c\uc7a5\ud588\ub2e4. \ub450 \ub9b4\ub9ac\uc988\ub294 \uc774\uc804 route rule advisory CVE-2026-53721<\/a>\uc5d0 \ub300\uc751\ud588\ub358 \ud300\ub3c4 \ub2e4\uc2dc \uc62c\ub824\uc57c \ud55c\ub2e4\uace0 \ub9d0\ud55c\ub2e4. \uc774\uc804 \uc218\uc815\uc5d0\uc11c \ubc1c\uc0dd\ud55c regression \ud558\ub098\ub97c \uc774\ubc88 \ud328\uce58\uac00 \ub2e4\ub8e8\uae30 \ub54c\ubb38\uc774\ub2e4.<\/p>\n

\ud655\uc778\ub41c \uc218\uc815 \ubc94\uc704:<\/strong> v4.5.1\uc740 server-side RCE, server island props\ub97c \ud1b5\ud55c \ubb34\ub2e8 \ucef4\ud3ec\ub10c\ud2b8 \uc778\uc2a4\ud134\uc2a4\ud654, route rule authorization bypass, server component DoS, \uce90\uc2dc \ud398\uc774\uc9c0\uc758 cross-user payload disclosure, dev server path disclosure\ub97c \uba85\uc2dc\ud55c\ub2e4. v3.21.10\uc740 \uc55e\uc758 \ub2e4\uc12f \ud56d\ubaa9(\uce90\uc2dc payload disclosure\ub97c \uc81c\uc678\ud55c \ubc94\uc704)\uc744 \uba85\uc2dc\ud55c\ub2e4. \uc591\ucabd \ub9b4\ub9ac\uc988\ub294 lockfile \uac31\uc2e0\uc73c\ub85c \ubcc4\ub3c4\uc758 critical development-only RCE\ub97c \uc218\uc815\ud55c @nuxt\/devtools 3.3.1<\/a>\ub3c4 \uac00\uc838\uc628\ub2e4\uace0 \uc548\ub0b4\ud55c\ub2e4.<\/p>\n

\uc5f0\uacb0\ub418\ub294 \uae30\ubc18 \ubcc0\ud654:<\/strong> 7\uc6d4 24\uc77c H3 v2.0.1-rc.26<\/a>\uc740 session cookie \uae30\ubcf8 SameSite=Lax<\/code>, HTML template interpolation escape, CORS\u00b7proxy\u00b7cookie\u00b7basic auth\u00b7body validation \ubcf4\uc815, x-forwarded-proto<\/code> \uc2e0\ub8b0\ub97c opt-in\uc73c\ub85c \ubc14\uafb8\ub294 \ubcc0\uacbd\uc744 \uacf5\uac1c\ud588\ub2e4. \uc774\ub294 Nuxt \uc548\uc815 \ud328\uce58\uc640 \ub3d9\uc77c \ub9b4\ub9ac\uc988\uac00 \uc544\ub2c8\uba70 RC\uc774\uc9c0\ub9cc, Nuxt\/Nitro \uacbd\uacc4\uc5d0\uc11c \ud504\ub85d\uc2dc\u00b7\ucfe0\ud0a4\u00b7\uc785\ub825 \uac80\uc99d\uc744 \ubcc4\ub3c4 \uc2dc\ud5d8\ud574\uc57c \ud558\ub294 \uc774\uc720\ub97c \ubcf4\uac15\ud55c\ub2e4.<\/p>\n

\uc65c \uc911\uc694\ud55c\uac00<\/h2>\n

\uc0ac\uc2e4:<\/strong> Nuxt\uac00 \uc774\ubc88 \ubc84\uc804\uc744 security release\ub85c \ubd84\ub958\ud558\uace0 \uac00\ub2a5\ud55c \ud55c \ube68\ub9ac \uc5c5\uadf8\ub808\uc774\ub4dc\ud558\ub77c\uace0 \uad8c\uace0\ud588\ub2e4. \ud574\uc11d:<\/strong> routeRules\uc640 server island, payload cache\ub294 UI \uc131\ub2a5 \uc635\uc158\uc774 \uc544\ub2c8\ub77c \uc694\uccad \uad8c\ud55c\u00b7\uc11c\ubc84 \ub80c\ub354\ub9c1\u00b7\uc0ac\uc6a9\uc790 \ub370\uc774\ud130 \ubd84\ub9ac\uc640 \ub9cc\ub098\ub294 \ubcf4\uc548 \uacbd\uacc4\ub2e4. \ud504\ub860\ud2b8\uc5d4\ub4dc \ud300\uc774 CDN \uc124\uc815, API middleware, preview deployment\ub97c \uc11c\ubc84\ud300\uc5d0 \ub118\uae34 \ucc44 \ubc84\uc804\ub9cc \uc62c\ub9ac\uba74 \ubcf4\ud638\uac00 \ubd88\uc644\uc804\ud560 \uc218 \uc788\ub2e4. \ucd94\uac00 \ud655\uc778:<\/strong> \uacf5\uc9c0\ub294 \ucde8\uc57d\ud55c \uc815\ud655\ud55c \ucf54\ub4dc \uacbd\ub85c\uc640 \uc11c\ube44\uc2a4\ubcc4 \ub178\ucd9c \uc870\uac74\uc744 \ubaa8\ub450 \ub300\uc2e0 \ud310\uc815\ud558\uc9c0 \uc54a\ub294\ub2e4. \uc571\uc758 Nuxt major\/minor, adapter, proxy, prerender \uc804\ub7b5, \uc9c1\uc811 \uc0ac\uc6a9\ud558\ub294 runtime compiler\uc640 server component\uac00 \uc2e4\uc81c \uc704\ud5d8\ub3c4\ub97c \uacb0\uc815\ud55c\ub2e4.<\/p>\n

\uc608\ub97c \ub4e4\uc5b4 payload extraction\uc744 \uc0ac\uc6a9\ud558\ub294 SSR \ud398\uc774\uc9c0\uc5d0\uc11c \uce90\uc2dc \ud0a4\uac00 \uc0ac\uc6a9\uc790\u00b7\uad8c\ud55c\u00b7query\uc5d0 \ucda9\ubd84\ud788 \ubd84\ub9ac\ub418\uc9c0 \uc54a\uc73c\uba74, \ucf54\ub4dc\uac00 \ud328\uce58\ub418\uc5b4\ub3c4 \uc774\ubbf8 CDN\uc5d0 \uc800\uc7a5\ub41c \uac1d\uccb4\ub294 \uc0b4\uc544 \uc788\uc744 \uc218 \uc788\ub2e4. \ubc18\ub300\ub85c \ubaa8\ub4e0 routeRules\ub97c \ubb34\uc791\uc815 \uaebc \ubc84\ub9ac\uba74 \uc131\ub2a5\uacfc \ube44\uc6a9\uc774 \uae09\ubcc0\ud55c\ub2e4. \ub530\ub77c\uc11c \u2018\uc5c5\ub370\uc774\ud2b8\u2019\uc640 \u2018\uce90\uc2dc purge\u2019, \u2018\uad00\ucc30\u2019, \u2018\ub864\ubc31\u2019\uc744 \ud55c \ubc30\ud3ec \ub2e8\uc704\ub85c \uc124\uacc4\ud574\uc57c \ud55c\ub2e4.<\/p>\n

1. \ud328\uce58 \ubc84\uc804 \uc120\ud0dd\uacfc lockfile \uac31\uc2e0\uc740 \ubd84\ub9ac\ud560 \uc218 \uc5c6\ub2e4<\/h3>\n

\ubcc0\uacbd \ub0b4\uc6a9:<\/strong> Nuxt\ub294 4.5 \uacc4\uc5f4\uc5d0 v4.5.1, 3.21 \uacc4\uc5f4\uc5d0 v3.21.10\uc744 \ubc30\ud3ec\ud558\uace0 npx nuxt upgrade --dedupe<\/code>\ub97c \uc81c\uc2dc\ud588\ub2e4. DevTools 3.3.1\uc758 development-only critical RCE\ub3c4 lockfile refresh\ub85c \uac00\uc838\uc628\ub2e4\uace0 \uc124\uba85\ud55c\ub2e4. \uc2e4\uc81c \uc601\ud5a5:<\/strong> package.json<\/code>\ub9cc \uc218\uc815\ud558\uace0 \uae30\uc874 pnpm-lock.yaml<\/code> \ub610\ub294 \ub2e4\ub978 lockfile\uc744 \uadf8\ub300\ub85c \ub450\uba74 \uc758\ub3c4\ud55c \uc804\uc774 \uc758\uc874\uc131\uc774 \uc124\uce58\ub418\uc9c0 \uc54a\uc744 \uc218 \uc788\ub2e4. \uc801\uc6a9\/\ud68c\ud53c \uc870\uac74:<\/strong> \ud604\uc7ac major\ub97c \uad50\ucc28 \uc5c5\uadf8\ub808\uc774\ub4dc\ud558\uc9c0 \ub9d0\uace0 \uc2e4\ud589 \uc911\uc778 3.21.x \ub610\ub294 4.5.x \ud328\uce58 \ub77c\uc778\uc744 \uc120\ud0dd\ud55c\ub2e4. production\uacfc development \ucee8\ud14c\uc774\ub108\uc758 lockfile \ud574\uc2dc\ub3c4 \uc77c\uce58\uc2dc\ud0a8\ub2e4. \uac80\uc99d \ubc29\ubc95:<\/strong> \uae68\ub057\ud55c CI workspace\uc5d0\uc11c frozen install, npx nuxt --version<\/code>, pnpm why nuxt @nuxt\/devtools<\/code>\ub85c \uc2e4\uc81c resolved version\uc744 \uae30\ub85d\ud558\uace0, production build\uc640 server start\ub97c \ubaa8\ub450 \ud1b5\uacfc\uc2dc\ud0a8\ub2e4.<\/p>\n

2. routeRules\ub294 \uad8c\ud55c\uacfc \uce90\uc2dc \ud0a4\ub97c \ud568\uaed8 \uac80\uc0ac\ud574\uc57c \ud55c\ub2e4<\/h3>\n

\ubcc0\uacbd \ub0b4\uc6a9:<\/strong> \ub450 \ud328\uce58 \ub77c\uc778\uc740 route rule authorization bypass\ub97c \uc218\uc815\ud558\uba70, \uc774\uc804 CVE-2026-53721 \ub300\uc751 \ud6c4\uc5d0\ub3c4 \uc0c8 \ub9b4\ub9ac\uc988\uac00 \ud544\uc694\ud558\ub2e4\uace0 \uacbd\uace0\ud55c\ub2e4. \uc2e4\uc81c \uc601\ud5a5:<\/strong> nuxt.config.ts<\/code>\uc758 routeRules<\/code>\ub294 redirect\u00b7cache\u00b7headers\u00b7prerender\ub97c \ud1b5\uc81c\ud558\ubbc0\ub85c URL \ub300\uc18c\ubb38\uc790, trailing slash, wildcard, middleware \uc21c\uc11c\uac00 \uad8c\ud55c \uc815\ucc45\uacfc \ub2e4\ub974\uba74 \uc6b0\ud68c \uacbd\ub85c\uac00 \uc0dd\uae38 \uc218 \uc788\ub2e4. \uc801\uc6a9\/\ud68c\ud53c \uc870\uac74:<\/strong> \uad00\ub9ac\uc790\u00b7\uacc4\uc815\u00b7preview\u00b7webhook \uacbd\ub85c\uc5d0 \ub113\uc740 wildcard cache\/redirect \uaddc\uce59\uc744 \ub450\uc9c0 \ub9d0\uace0, \uc778\uc99d\uc740 route rule\ub9cc\uc774 \uc544\ub2c8\ub77c server middleware\/API handler\uc5d0\uc11c\ub3c4 \uac80\uc99d\ud55c\ub2e4. \uac80\uc99d \ubc29\ubc95:<\/strong> Playwright \ub610\ub294 curl fixture\ub85c \ub300\uc18c\ubb38\uc790, \uc778\ucf54\ub529, trailing slash, query \uc870\ud569, redirect chain\uc744 \uc0dd\uc131\ud55c\ub2e4. \uc775\uba85\u00b7\uc77c\ubc18 \uc0ac\uc6a9\uc790\u00b7\uad00\ub9ac\uc790 \uc138\uc158\ubcc4 status, Location, Cache-Control, body\uc640 audit log\ub97c \ube44\uad50\ud574 \uad8c\ud55c\uc774 \uad50\ucc28\ud558\uc9c0 \uc54a\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/p>\n

3. server island props\uc640 runtime compiler \uc785\ub825\uc744 \uc2e0\ub8b0\ud558\uc9c0 \uc54a\ub294\ub2e4<\/h3>\n

\ubcc0\uacbd \ub0b4\uc6a9:<\/strong> \uacf5\uc2dd \ub9b4\ub9ac\uc988\ub294 server island props\ub97c \ud1b5\ud55c unauthorized component instantiation\uacfc server component DoS\ub97c \uc218\uc815\ud588\uace0, v4.5.1 changelog\ub294 island props\/v-for \uacbd\uacc4\ub97c \uc81c\ud55c\ud558\uace0 runtime compiler\uc758 reserved prop\uc744 \uac70\ubd80\ud558\ub294 \ubcc0\uacbd\uc744 \uae30\ub85d\ud55c\ub2e4. \uc2e4\uc81c \uc601\ud5a5:<\/strong> SSR\uc5d0\uc11c URL \ub610\ub294 \uc678\ubd80 CMS \ub370\uc774\ud130\ub97c props\ub85c \uc804\ub2ec\ud558\ub294 \ud328\ud134\uc740 \uc608\uc0c1\ud558\uc9c0 \uc54a\uc740 \ucef4\ud3ec\ub10c\ud2b8 \uc120\ud0dd\u00b7\uacfc\ub3c4\ud55c \ubc18\ubcf5\u00b7\ub80c\ub354 \ube44\uc6a9\uc73c\ub85c \uc774\uc5b4\uc9c8 \uc218 \uc788\ub2e4. \uc801\uc6a9\/\ud68c\ud53c \uc870\uac74:<\/strong> \uc0ac\uc6a9\uc790 \uc785\ub825\uc744 component name, template, dynamic import key\uc5d0 \uc9c1\uc811 \ub123\uc9c0 \uc54a\uc73c\uba70, island prop\uc740 schema validation\uacfc \uae38\uc774\u00b7\ubc30\uc5f4 \ud06c\uae30 \uc0c1\ud55c\uc744 \ub454\ub2e4. runtime compiler\uac00 \ud544\uc694 \uc5c6\ub294 \uc571\uc740 \ub048\ub2e4. \uac80\uc99d \ubc29\ubc95:<\/strong> tests\/security\/islands.spec.ts<\/code>\uc5d0 \uc608\uc57d\ub41c prop, \ubbf8\ub4f1\ub85d component, \ub300\ud615 \ubc30\uc5f4, \uae4a\uc740 \uc911\ucca9 \uac1d\uccb4\ub97c \ub123\uace0 4xx\/\uc548\uc804\ud55c \uc2e4\ud328\uc640 CPU\u00b7\uba54\ubaa8\ub9ac\u00b7\uc751\ub2f5\uc2dc\uac04 \uc0c1\ud55c\uc744 assert\ud55c\ub2e4. \uc2a4\ud14c\uc774\uc9d5 WAF\/\ub85c\uadf8\uc5d0\uc11c\ub3c4 \ubc18\ubcf5 \uc694\uccad\uc774 \uc11c\ubc84 worker\ub97c \uace0\uac08\uc2dc\ud0a4\uc9c0 \uc54a\ub294\uc9c0 \ubcf8\ub2e4.<\/p>\n

4. payload cache\ub294 \uc5c5\uadf8\ub808\uc774\ub4dc \ud6c4 purge\uc640 \uaca9\ub9ac \ud655\uc778\uc774 \ud544\uc218\ub2e4<\/h3>\n

\ubcc0\uacbd \ub0b4\uc6a9:<\/strong> v4.5.1\uc740 cached pages\uc758 cross-user payload disclosure\ub97c \uba85\uc2dc\ud558\uace0, cache<\/code>\/swr<\/code>\/isr<\/code> route rule \uc0ac\uc6a9\uc790\ub294 CDN \ub610\ub294 edge cache\ub97c purge\ud558\ub77c\uace0 \uc548\ub0b4\ud55c\ub2e4. \uc2e4\uc81c \uc601\ud5a5:<\/strong> \ud328\uce58\ub41c origin\uc774 \uc548\uc804\ud574\ub3c4 edge\uc758 \uc774\uc804 _payload.json<\/code>\uc740 \uc0ac\uc6a9\uc790\ubcc4 \ub370\uc774\ud130\ub098 \uc624\ub798\ub41c \uad8c\ud55c \uc0c1\ud0dc\ub97c \uacc4\uc18d \ubc18\ud658\ud560 \uc218 \uc788\ub2e4. \uc801\uc6a9\/\ud68c\ud53c \uc870\uac74:<\/strong> \uac1c\uc778\ud654 \ud398\uc774\uc9c0\uc5d0\ub294 public cache\ub97c \ud53c\ud558\uace0, \uaf2d \ud544\uc694\ud558\uba74 user\/session \uae30\uc900 cache \ubd84\ub9ac\uc640 \uc751\ub2f5\uc758 Vary<\/code>, Cache-Control<\/code>\uc744 \uba85\uc2dc\ud55c\ub2e4. purge API token\uc740 CI\uc5d0 \ucd5c\uc18c \uad8c\ud55c\uc73c\ub85c \ub454\ub2e4. \uac80\uc99d \ubc29\ubc95:<\/strong> \uc11c\ub85c \ub2e4\ub978 \ub450 \ud14c\uc2a4\ud2b8 \uacc4\uc815\uc73c\ub85c \ub85c\uadf8\uc778 \ud6c4 HTML\uacfc _payload.json<\/code>\uc744 \uac01\uac01 \uc218\uc9d1\ud558\uace0, \uacc4\uc815 \uc2dd\ubcc4\uc790\u00b7\uad8c\ud55c \ud544\ub4dc\uac00 \uc11e\uc774\uc9c0 \uc54a\ub294\uc9c0 \uc790\ub3d9 diff\ud55c\ub2e4. purge \uc804\ud6c4 CDN HIT\/MISS\uc640 Age \ud5e4\ub354\ub97c \uae30\ub85d\ud558\uace0, \uce90\uc2dc\ub41c URL \ubaa9\ub85d\uc744 \ubc30\ud3ec \uc99d\ube59\uc5d0 \ub0a8\uae34\ub2e4.<\/p>\n

5. DevTools\uc640 \ud504\ub85d\uc2dc \uacbd\uacc4\ub294 \u2018\uac1c\ubc1c \uc804\uc6a9\u2019\uc774\ub77c\ub3c4 \uc6b4\uc601 \ubcf4\uc548\uc5d0 \uc5f0\uacb0\ub41c\ub2e4<\/h3>\n

\ubcc0\uacbd \ub0b4\uc6a9:<\/strong> Nuxt\ub294 dev server path disclosure\uc640 \ubcc4\ub3c4 DevTools critical development-only RCE\ub97c \uc5b8\uae09\ud55c\ub2e4. H3 RC\ub294 x-forwarded-proto<\/code> \uc2e0\ub8b0\ub97c opt-in\uc73c\ub85c \ud558\uace0 proxy\/CORS\/basic auth \ucc98\ub9ac\ub3c4 \ubcf4\uac15\ud588\ub2e4. \uc2e4\uc81c \uc601\ud5a5:<\/strong> \uac1c\ubc1c \uc11c\ubc84\ub97c LAN\u00b7\ud130\ub110\u00b7preview \ud658\uacbd\uc5d0 \ub178\ucd9c\ud558\uac70\ub098 reverse proxy\uac00 \uc784\uc758 forwarded header\ub97c \uc804\ub2ec\ud558\uba74 \uac1c\ubc1c \uc804\uc6a9\uc774\ub77c\uace0 \uc0dd\uac01\ud588\ub358 \ud45c\uba74\uc774 \uc678\ubd80 \uc785\ub825\uc744 \ubc1b\ub294\ub2e4. \uc801\uc6a9\/\ud68c\ud53c \uc870\uac74:<\/strong> dev server\uc640 DevTools\ub294 loopback\/VPN\uc5d0 \uc81c\ud55c\ud558\uace0, preview \ud658\uacbd\ub3c4 \uc778\uc99d\ud55c\ub2e4. trusted proxy \ubaa9\ub85d\uc744 \uba85\uc2dc\ud558\uba70 \uc784\uc758 \ud074\ub77c\uc774\uc5b8\ud2b8 forwarded header\ub97c \uc2e0\ub8b0\ud558\uc9c0 \uc54a\ub294\ub2e4. H3 RC\ub294 Nuxt\uac00 \uace0\uc815\ud55c \ubc84\uc804\uc744 \uc6b0\ud68c\ud574 \uac15\uc81c \uc8fc\uc785\ud558\uc9c0 \uc54a\ub294\ub2e4. \uac80\uc99d \ubc29\ubc95:<\/strong> \uc678\ubd80 \ub124\ud2b8\uc6cc\ud06c\uc640 trusted\/untrusted proxy \uc591\ucabd\uc5d0\uc11c path \ud0d0\uc0c9\u00b7forwarded header\u00b7CORS preflight\ub97c \uc2dc\ud5d8\ud558\uace0, dev endpoint\uac00 \uacf5\uac1c\ub418\uc9c0 \uc54a\uc73c\uba70 production scheme\/cookie security\uac00 \ubc14\ub00c\uc9c0 \uc54a\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/p>\n

\uac1c\ubc1c\uc790 \uc2e4\ud589 \uacc4\ud68d<\/h2>\n
    \n
  1. P0:<\/strong> \ubc30\ud3ec \uc911\uc778 \uc774\ubbf8\uc9c0\uc640 package.json<\/code>\/pnpm-lock.yaml<\/code>\uc5d0\uc11c Nuxt\u00b7DevTools \uc2e4\uc81c \ubc84\uc804\uc744 \ucd94\ucd9c\ud574 3.21.x\u21923.21.10 \ub610\ub294 4.5.x\u21924.5.1 \uacc4\ud68d\uc744 \ub9cc\ub4e0\ub2e4.<\/li>\n
  2. P0:<\/strong> \ub3c5\ub9bd PR\uc5d0\uc11c npx nuxt upgrade --dedupe<\/code>\ub97c \uc2e4\ud589\ud558\uace0 lockfile diff\ub97c \ub9ac\ubdf0\ud55c\ub2e4. \uae68\ub057\ud55c install\uacfc production build\ub97c CI \ud544\uc218 \uac80\uc0ac\ub85c \uc2e4\ud589\ud55c\ub2e4.<\/li>\n
  3. P0:<\/strong> nuxt.config.ts<\/code>\uc758 routeRules<\/code>, cache<\/code>, swr<\/code>, isr<\/code> \uc0ac\uc6a9 \uacbd\ub85c\ub97c \ubaa9\ub85d\ud654\ud55c\ub2e4. \uac1c\uc778\ud654\u00b7\uad00\ub9ac \uacbd\ub85c\uc5d0\ub294 public caching\uc774 \uc5c6\ub294\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/li>\n
  4. P0:<\/strong> CDN\/edge purge\ub97c \ubc30\ud3ec runbook\uc5d0 \ub123\uace0, purge \uc644\ub8cc \ud6c4 \ub450 \uacc4\uc815\uc758 HTML\u00b7_payload.json<\/code> \uaca9\ub9ac \ud14c\uc2a4\ud2b8\ub97c \uc218\ud589\ud55c\ub2e4.<\/li>\n
  5. P1:<\/strong> server island\uc640 server component\uc758 props\uc5d0 Zod\/valibot \ub4f1 schema, \uae38\uc774\u00b7\ubc30\uc5f4\u00b7\uc911\ucca9 \uc0c1\ud55c\uc744 \uc801\uc6a9\ud55c\ub2e4. dynamic component\/renderer \uc785\ub825\uc744 allowlist\ub85c \ubc14\uafbc\ub2e4.<\/li>\n
  6. P1:<\/strong> route authorization matrix\ub97c \ud14c\uc2a4\ud2b8\ub85c \ucd94\uac00\ud55c\ub2e4. \ub300\uc18c\ubb38\uc790\u00b7slash\u00b7redirect\u00b7query\ubcc4 \uc775\uba85\/\uad8c\ud55c\ubcc4 \uc751\ub2f5\uacfc cache header\ub97c \uad00\ucc30\ud55c\ub2e4.<\/li>\n
  7. P1:<\/strong> DevTools\/dev server\ub97c \uc778\ud130\ub137\uc5d0\uc11c \ucc28\ub2e8\ud558\uace0, preview\uc758 reverse proxy\u00b7forwarded header\u00b7CORS \uc815\ucc45\uc744 \uc810\uac80\ud55c\ub2e4.<\/li>\n
  8. P2:<\/strong> canary\uc5d0\uc11c SSR 5xx, p95 render time, cache HIT ratio, 401\/403 \ube44\uc728, payload \ud06c\uae30, CDN purge \uc2e4\ud328\ub97c \uc774\uc804 \ubc30\ud3ec\uc640 \ube44\uad50\ud55c\ub2e4.<\/li>\n<\/ol>\n

    \ub9ac\uc2a4\ud06c\uc640 \ud55c\uacc4<\/h2>\n

    \uc774 \uae00\uc740 \uacf5\uc2dd \ub9b4\ub9ac\uc988\uc640 advisory\uac00 \ud655\uc778\ud55c \ubc94\uc704\ub97c \uc6b4\uc601 \uc758\uc0ac\uacb0\uc815\uc73c\ub85c \ud574\uc11d\ud55c \uac83\uc774\ub2e4. \uac1c\ubcc4 \uc571\uc758 \ub178\ucd9c \uc5ec\ubd80\ub294 custom module, adapter, CDN, proxy, route \uaddc\uce59, \uc778\uc99d middleware\uc5d0 \ub530\ub77c \ub2e4\ub974\ub2e4. \ud328\uce58 \uc9c1\ud6c4\uc758 \uc704\ud5d8\uc740 \ud638\ud658\uc131\ubcf4\ub2e4 \uc54c\ub824\uc9c4 \ubcf4\uc548 \uacbd\uacc4\uc77c \uc218 \uc788\uc9c0\ub9cc, lockfile dedupe\ub294 \ub2e4\ub978 \uc804\uc774 \uc758\uc874\uc131\ub3c4 \uc6c0\uc9c1\uc77c \uc218 \uc788\uc73c\ubbc0\ub85c \ubcc0\uacbd\uc744 \uae30\ub2a5 \ub9b4\ub9ac\uc988\uc640 \uc11e\uc9c0 \uc54a\ub294\ub2e4. \ub864\ubc31 \uc870\uac74\uc740 \uc0c8 build\/SSR \uc624\ub958 \uc99d\uac00, \ub85c\uadf8\uc778\u00b7middleware \ud68c\uadc0, \uc608\uc0c1 \ubc16 cache MISS \ube44\uc6a9 \uae09\uc99d, CDN purge \uc2e4\ud328\ub2e4. \ub2e8, \ubcf4\uc548 \ucde8\uc57d \ubc84\uc804\uc73c\ub85c \ub2e8\uc21c \ubcf5\uadc0\ud558\uc9c0 \ub9d0\uace0 \ud2b8\ub798\ud53d \ucc28\ub2e8\u00b7\ubb38\uc81c route rule \ube44\ud65c\uc131\ud654\u00b7\uce90\uc2dc \ubb34\ud6a8\ud654\u00b7\uc0c8 hotfix canary \uac19\uc740 \uc644\ud654\ucc45\uc744 \uc6b0\uc120\ud558\uace0, \ubd88\uac00\ud53c\ud55c \ub864\ubc31\uc740 \uc811\uadfc \uc81c\uc5b4\ub97c \uac15\ud654\ud55c \uc9e7\uc740 \ucc3d\uc73c\ub85c \uc81c\ud55c\ud55c\ub2e4.<\/p>\n

    FAQ<\/h2>\n

    Nuxt 3\ub3c4 v3.21.10\uc73c\ub85c \uc989\uc2dc \uc5c5\ub370\uc774\ud2b8\ud574\uc57c \ud558\ub098?<\/h3>\n

    \ud604\uc7ac 3.21.x\ub97c \uc6b4\uc601\ud558\uace0 \uc788\ub2e4\uba74 \uacf5\uc2dd v3.21.10 \ub9b4\ub9ac\uc988\ub294 \ubcf4\uc548 \ud328\uce58\ub85c \ubd84\ub958\ub418\uba70 \uac00\ub2a5\ud55c \ud55c \ube68\ub9ac \uc5c5\uadf8\ub808\uc774\ub4dc\ud558\ub77c\uace0 \uad8c\uace0\ud55c\ub2e4. \uba3c\uc800 \uc2a4\ud14c\uc774\uc9d5\uc5d0\uc11c lockfile\u00b7SSR\u00b7route authorization\uc744 \ud655\uc778\ud558\ub418, \uc77c\ubc18 \uae30\ub2a5 \ub9b4\ub9ac\uc988\uae4c\uc9c0 \uae30\ub2e4\ub9ac\ub294 \ubc29\uc2dd\uc740 \uad8c\uc7a5\ub418\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

    Nuxt v4.5.1 \ub4a4 CDN \uce90\uc2dc\ub97c \uc65c \ube44\uc6cc\uc57c \ud558\ub098?<\/h3>\n

    v4.5.1\uc740 cached pages\uc758 cross-user payload disclosure \uc218\uc815\uc744 \ud3ec\ud568\ud558\uace0, Nuxt\ub294 cache\/swr\/isr route rule \uc0ac\uc6a9 \uc2dc \uae30\uc874 _payload.json<\/code>\uc774 edge\uc5d0 \ub0a8\uc744 \uc218 \uc788\ub2e4\uace0 \uba85\uc2dc\ud55c\ub2e4. origin \ubc30\ud3ec \uc131\uacf5\ub9cc \ud655\uc778\ud558\uc9c0 \ub9d0\uace0 purge\uc640 \uacc4\uc815 \uac04 payload \uaca9\ub9ac \uac80\uc99d\uc744 \ud574\uc57c \ud55c\ub2e4.<\/p>\n

    H3 rc.26\uc744 Nuxt \ud504\ub85c\uc81d\ud2b8\uc5d0 \uc9c1\uc811 \uc62c\ub824\ub3c4 \ub418\ub294\uac00?<\/h3>\n

    \uad8c\uc7a5\ud558\uc9c0 \uc54a\ub294\ub2e4. rc.26\uc740 \ub9b4\ub9ac\uc988 \ud6c4\ubcf4\uc774\uba70 Nuxt\ub294 \uc758\uc874 H3 \ubc84\uc804\uc744 \uace0\uc815\ud560 \uc218 \uc788\ub2e4. \uc774\ubc88 \uae00\uc5d0\uc11c H3\ub294 \ud504\ub85d\uc2dc\u00b7\ucfe0\ud0a4\u00b7\uc785\ub825 \uac80\uc99d \ud14c\uc2a4\ud2b8\uc758 \ub9e5\ub77d\uc774\ub2e4. Nuxt \uacf5\uc2dd \ud638\ud658 \ubc94\uc704 \uc548\uc758 \uc5c5\ub370\uc774\ud2b8\ub97c \uc6b0\uc120\ud558\uace0, \uc9c1\uc811 H3\ub97c \uc4f0\ub294 \uc11c\ube44\uc2a4\ub9cc \ubcc4\ub3c4 canary\uc5d0\uc11c \uc2dc\ud5d8\ud55c\ub2e4.<\/p>\n

    \ucd9c\ucc98 \ubc0f \ucd94\uac00 \uc77d\uae30<\/h2>\n