Read the docs
TI-2026-34788 Aliases CVE-2026-47200GHSA-hg3f-28rg-4jxj

Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Priority HIGH 67CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nuxt (nuxt): 3.21.6, 4.4.6nuxt (npm): 3.21.6, 4.4.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt3.11.0 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.63.21.6, 4.4.6Patch availableCNA
—nuxt (npm)3.11.0 to before 3.21.63.21.6Patch availableGHSA-hg3f-28rg-4jxj
—@nuxt/nitro-server (npm)3.20.0 to before 3.21.63.21.6Patch availableGHSA-hg3f-28rg-4jxj
—@nuxt/nitro-server (npm)4.2.0 to before 4.4.64.4.6Patch availableGHSA-hg3f-28rg-4jxj
—nuxt (npm)4.0.0-alpha.1 to before 4.4.64.4.6Patch availableGHSA-hg3f-28rg-4jxj
  • nuxt Vendornuxt Affected 3.11.0 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.6 Fixed in 3.21.6, 4.4.6 Patch available CNA
  • nuxt (npm) Vendor— Affected 3.11.0 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-hg3f-28rg-4jxj
  • @nuxt/nitro-server (npm) Vendor— Affected 3.20.0 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-hg3f-28rg-4jxj
  • @nuxt/nitro-server (npm) Vendor— Affected 4.2.0 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-hg3f-28rg-4jxj
  • nuxt (npm) Vendor— Affected 4.0.0-alpha.1 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-hg3f-28rg-4jxj

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*3.11.0 to before 3.21.6; 4.0.0 to before 4.4.6Vulnerablenuxt
cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:*3.20.0 to before 3.21.6; 4.2.0 to before 4.4.6Vulnerablenuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions 3.11.0 to before 3.21.6; 4.0.0 to before 4.4.6 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:* Versions 3.20.0 to before 3.21.6; 4.2.0 to before 4.4.6 Vulnerable ·nuxt

Remediation

  • Fix · CNA nuxt (nuxt) Fixed in 3.21.6, 4.4.6
  • Fix · GHSA-hg3f-28rg-4jxj nuxt (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-hg3f-28rg-4jxj @nuxt/nitro-server (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-hg3f-28rg-4jxj @nuxt/nitro-server (npm) Fixed in 4.4.6 Advisory →
  • Fix · GHSA-hg3f-28rg-4jxj nuxt (npm) Fixed in 4.4.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47200
  2. 2026-10-03 Alias added: GHSA-hg3f-28rg-4jxj

References

Exploit 1

Advisory 1

Other 3

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2024-22684 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVSS 3.1MEDIUM 6.3
  • TI-2023-00833 Cross-site Scripting (XSS) - Generic in nuxt/framework CVSS 3.1MEDIUM 6.1
  • TI-2026-33411 Nuxt: Reflected XSS in `navigateTo()` external redirect CVSS 4.0MEDIUM 5.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences