CVE-2026-46342 Details
Description
Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.
A vulnerability exists in Nuxt versions 3.1.0 prior to 3.21.6, 4.0.0-alpha.1 prior to 4.4.6, and in @nuxt/nitro-server versions 3.20.0 prior to 3.21.6 and 4.0.0-alpha.1 prior to 4.4.6. The issue arises in the '/__nuxt_island/*' endpoint, which accepts attacker-controlled 'props' query or body parameters. The endpoint renders island components without verifying that the corresponding URL-resident hash was legitimately issued for those inputs. This lack of server-side validation allows the same path to return significantly different responses based on the query. The vulnerability can be exploited to poison the cache of applications using a CDN or reverse proxy that keys '/__nuxt_island/*' requests by path only, leading to unauthorized content being served to users.
Users can upgrade to Nuxt versions 3.21.6 or 4.4.6. For those unable to upgrade immediately, it's recommended to ensure that any intermediary cache keys '/__nuxt_island/*' on the full query string, not just the path. Additionally, audit application-authored islands for props that may be directed into 'v-html', 'innerHTML', or similar HTML sinks, treating those props as untrusted user input.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/pull/35077 | [email protected] | Issue Tracking |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | [email protected] |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt | >= 3.1.0, < 3.21.6 >= 4.0.0, < 4.4.5 |
CPE
Remediation
| |
| nuxt nuxt/nitro-server | >= 3.20.0, < 3.21.6 >= 4.2.0, < 4.4.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |