CVE-2026-46342Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
Description
Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| nuxt | nuxt | >= 3.1.0, < 3.21.6, >= 4.0.0-alpha.1, < 4.4.6 | |
| nuxt | nuxt/nitro-server | 3.20.0 – < 3.21.6 |
References and patches
- https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v MitigationPatchVendor Advisory
- https://github.com/nuxt/nuxt/pull/35077 Issue Tracking
CPE matches (NVD) (4)
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.21.6cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.4.5cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:*≥ 3.20.0 < 3.21.6cpe:2.3:a:nuxt:nuxt\/nitro-server:*:*:*:*:*:node.js:*:*≥ 4.2.0 < 4.4.6