fix(cspSsrNonce): more robust tag replacement

[GalacticHypernova]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

Closes #594
Closes #610
The previous regex implementation, upon further review, had quite a few edge cases. Custom elements, and tags within other elements' props, can cause false modifications, yielding unexpected behavior. This PR fixes the regexes to make them much more robust, fixing said pitfalls. It uses a 2 step approach to mask stringified elements and word-boundaried regex to fix custom elements

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)

[vercel]

@GalacticHypernova is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.

[GalacticHypernova]

Hey @vejja @Baroshem

Sorry for the double mention, but could this be prioritized for a push?

I tried to make a test for the fix (as you can see from the below commits) but I unfortunately failed. If you could assist with writing the test that would be appreciated (it's commented out in the ssr nonce test file)

[GalacticHypernova]

This appears to be even more performant than current variation (I'm assuming maybe the word boundary has something to do with that), but we can probably optimize it further. For exanple, we could perhaps quote entire attribute lines as opposed to individual attribute values, which might lead to a moderately smaller internal array, but it is low priority as the current approach is not a bottleneck, so this optimization could be safely pushed separately and should not be a blocker for merging this fix.

[GalacticHypernova]

I just pushed a PR to Nuxt Image to remove the insecure nonce prop, hopefully it is merged and allows us to simplify link handling 😅

[Baroshem]

Great work, thanks!

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
nuxt-security	Ready	Preview	Comment	Nov 14, 2025 9:33am