Vue 2, end of life since 31 December 2023
Vue 2.7.16 vulnerabilities
Vue 2.7.16 is the last Vue 2 release. The OSV open-source vulnerability database lists 1 vulnerability for this version, none of them critical. Vue 2 gets no more fixes from the Vue team.
- 1known vulnerabilities
- 0critical
- 0high
- 0exploited in the wild
What you can do
Keep Vue 2.7.16, patched
We backport the security fixes to the Vue 2 version your application loads, tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to Vue 3 once your components and libraries can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 1 known vulnerability in Vue 2.7.16
OSV.dev, the open-source vulnerability database used by GitHub and Google, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where OSV records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2024-9506 | 3.7 | Low | 2024-10-15 | 3.0.0-alpha.0 | ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function |