Read the docs
TI-2026-34062 Aliases CVE-2026-46342GHSA-g8wj-3cr3-6w7v

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Priority LOW 11CWE-349Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00091 0th percentileScored 2026-11-07
Fix Fixed nuxt (nuxt): 3.21.6, 4.4.6nuxt (npm): 3.21.6, 4.4.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt3.1.0 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.63.21.6, 4.4.6Patch availableCNA
—nuxt (npm)3.1.0 to before 3.21.63.21.6Patch availableGHSA-g8wj-3cr3-6w7v
—nuxt (npm)4.0.0-alpha.1 to before 4.4.64.4.6Patch availableGHSA-g8wj-3cr3-6w7v
—@nuxt/nitro-server (npm)3.20.0 to before 3.21.63.21.6Patch availableGHSA-g8wj-3cr3-6w7v
—@nuxt/nitro-server (npm)4.2.0 to before 4.4.64.4.6Patch availableGHSA-g8wj-3cr3-6w7v
  • nuxt Vendornuxt Affected 3.1.0 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.6 Fixed in 3.21.6, 4.4.6 Patch available CNA
  • nuxt (npm) Vendor— Affected 3.1.0 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-g8wj-3cr3-6w7v
  • nuxt (npm) Vendor— Affected 4.0.0-alpha.1 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-g8wj-3cr3-6w7v
  • @nuxt/nitro-server (npm) Vendor— Affected 3.20.0 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-g8wj-3cr3-6w7v
  • @nuxt/nitro-server (npm) Vendor— Affected 4.2.0 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-g8wj-3cr3-6w7v

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*3.1.0 to before 3.21.6; 4.0.0 to before 4.4.5Vulnerablenuxt
cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:*3.20.0 to before 3.21.6; 4.2.0 to before 4.4.6Vulnerablenuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.21.6; 4.0.0 to before 4.4.5 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:* Versions 3.20.0 to before 3.21.6; 4.2.0 to before 4.4.6 Vulnerable ·nuxt

Remediation

  • Fix · CNA nuxt (nuxt) Fixed in 3.21.6, 4.4.6
  • Fix · GHSA-g8wj-3cr3-6w7v nuxt (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-g8wj-3cr3-6w7v nuxt (npm) Fixed in 4.4.6 Advisory →
  • Fix · GHSA-g8wj-3cr3-6w7v @nuxt/nitro-server (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-g8wj-3cr3-6w7v @nuxt/nitro-server (npm) Fixed in 4.4.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46342
  2. 2026-10-03 Alias added: GHSA-g8wj-3cr3-6w7v

References

Patch 1

Advisory 1

Other 2

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2026-34788 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CVSS 4.0MEDIUM 6.3
  • TI-2024-22684 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVSS 3.1MEDIUM 6.3
  • TI-2023-00833 Cross-site Scripting (XSS) - Generic in nuxt/framework CVSS 3.1MEDIUM 6.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences