Nuxt app hangs after build when using PGlite multi-tab worker with nuxt-security

[Us3r-gitHub]

Environment

|                      |                                                                  |
| -------------------- | ---------------------------------------------------------------- |
| **Operating system** | `Linux 6.14.0-37-generic`                                        |
| **CPU**              | `Intel(R) Core(TM) i7-10750H CPU @ 2.60GHz (12 cores)`           |
| **Node.js version**  | `v25.2.1`                                                        |
| **nuxt/cli version** | `3.31.3`                                                         |
| **Package manager**  | `pnpm@10.24.0`                                                   |
| **Nuxt version**     | `4.2.2`                                                          |
| **Nitro version**    | `2.12.9`                                                         |
| **Builder**          | `vite@7.3.0`                                                     |
| **Config**           | `compatibilityDate`, `devtools`, `modules`, `security`, `vite`   |
| **Modules**          | `nuxt-security@2.5.0`                                            |

Nuxt Security Version

2.5.0

Default setup used?

No, the bug happens only when I set custom values for the security option

Security options

security: {
    headers: {
      contentSecurityPolicy: {
        "script-src": [
          "'self'",
          "https:",
          "'unsafe-inline'",
          "'strict-dynamic'",
          "'nonce-{{nonce}}'",
          "'wasm-unsafe-eval'", // <- Add this line to work with pglite
        ],
      },
    },
  },

Reproduction

👉 on branch (nuxt-security)

Description

• What happens ?
  After running pnpm run build and pnpm run preview, the Nuxt application shows a blank screen and appears to hang.

• What is expected to happen ?
  The application should start and render normally after build, the same as in dev mode.

Notes

• No logs or errors are produced
• Issue happens only in production (preview)
• Might be related to useCsrfFetch is not working after running "npm run build" in production #583

Additional context

** Scenarios **

Scenario	nuxt-security	PGlite worker	Dev (pnpm run dev)	Build + Preview
1. Basic PGlite	✅	❌	✅ Works	✅ Works
2. PGlite multi-tab worker	✅	✅	✅ Works	❌ Hangs / blank screen
3. No nuxt-security	❌	✅	✅ Works	✅ Works

---

Related Commits

• Scenario 1 (basic PGlite):
  Us3r-gitHub/Playground@3b940e3

• Scenario 2 (PGlite multi-tab worker):
  Us3r-gitHub/Playground@9d603eb

• Scenario 3 (No nuxt-security):
  Us3r-gitHub/Playground@bd471ee

---

Screenshots

• Scenario 1

• Scenario 2

• Scenario 3

Logs

There are **no errors or logs** in the terminal or browser console.

[Baroshem]

Hey Buddy,

Thanks for creating this issue.

However, I am affraid that I have no clue what the issue could be. Could you try to disable certain middleware functions to see which one is causing this issue?

Just to narrow down which one is problematic so that we can try to debug what the problem is.

[Baroshem]

EDIT:

Ah I see that you have added a custom option to CSP.

AFAIK, we are just passing the response header without doing any transformations on it so maybe this particular one casues issues to your case? Have you tried looking the web for compatibility with this specific header to your PG case?

[Baroshem]

Could you also send a screenshot of response headers that are being set? In the network tab?