Integration guide

Everything needed to link nuxt from this mirror: which build to pick, how caching behaves, and how to verify what you loaded.

1. Pick a build

Build	When to use it
nuxt.global.js	Readable, unminified. Debugging only.
nuxt.global.min.js	Plain `<script>` tag, registers a global. Most sites want this.
nuxt.esm.js	`import` from a module script or another ES module.

2. Pin a version

URLs are versioned by path segment: /v/<semver>/<file>. Pin an exact version for anything user-facing:

https://nuxt.cdnwave.org/v/3.13.2/nuxt.global.min.js

A rolling alias exists for local prototyping. It repoints to the newest release and is not integrity-stable across releases, so don't pair it with a fixed SRI hash:

https://nuxt.cdnwave.org/latest/nuxt.global.min.js

3. Verify with Subresource Integrity

Every pinned file ships a published sha384 digest — see the package overview or the version table. Recompute it yourself against the file you fetched:

openssl dgst -sha384 -binary nuxt.global.min.js | openssl base64 -A

Wire the result into the tag:

<script
  src="https://nuxt.cdnwave.org/v/3.13.2/nuxt.global.min.js"
  integrity="sha384-lm3rcqU2yk91uFfpdwJObfqQotvhkigrfhSZBXbODRhqbwjsWCjPCEk6pkNxLkjl"
  crossorigin="anonymous"></script>

Mismatched hashes reject the load in the browser rather than executing altered content — keep crossorigin="anonymous" set, or the integrity check is silently skipped by some browsers.

4. Caching behavior

Path	`Cache-Control`	Notes
/v/<version>/*	public, max-age=31536000, immutable	Versioned files never change content — cache forever, client and edge alike.
/latest/*	public, max-age=300	Re-checked every 5 minutes so the alias catches new releases promptly.
/*.html	public, max-age=600	These package pages, including this one.

5. CORS

All static assets are served with Access-Control-Allow-Origin: *, so cross-origin fetch() and module imports work without a proxy. No cookies or credentials are attached to these requests.