The bomb went off at around 11 a.m. (10:00 GMT) near the university library, a few hours after police received a phone warning from Basque separatist group ETA, who did not specify where the device was hidden.
The powerful blast set 10 cars on fire and damaged 30 others. The victims, mostly students, were injured by flying glass shards and have been taken to hospital. None were critically injured.
The university has put the number of injured at 17.
The attack came two days after Spanish police arrested four suspected ETA militants in a joint operation in Pamplona and Valencia. Police said the suspects had been planning terrorist attacks in the region.
The University of Navarre has suffered six ETA attacks in the past 29 years.
ETA, listed as a terrorist organization by Spain, France, the United States and the European Union, is fighting for an independent Basque state in northern Spain and southwestern France for nearly half a century.
