PT-2026-42038 · Npm+2 · @Nuxt/Nitro-Server+1
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Nuxt versions 3.1.0 through 3.21.5
Nuxt versions 4.0.0-alpha.1 through 4.4.5
@nuxt/nitro-server versions 3.20.0 through 3.21.5
@nuxt/nitro-server versions 4.0.0-alpha.1 through 4.4.5
Description
The '/ nuxt island/*' endpoint accepts attacker-controlled
props query or body parameters and renders island components without verifying that the URL-resident hash (<Name> <hashId>.json) was issued for those specific inputs by <NuxtIsland>. Because the hash is computed client-side and not validated on the server, the same path can return different responses based on the query. In environments where a CDN or reverse-proxy caches this endpoint by path only (ignoring the query), an attacker can prime the cache with their own props, causing subsequent users to receive the attacker's rendered HTML. If the application code passes a prop into an unsafe HTML sink (such as v-html or innerHTML), this can lead to stored Cross-Site Scripting (XSS) in the embedding page's origin until the cache entry expires.Recommendations
Update Nuxt to version 3.21.6 or 4.4.6.
Update @nuxt/nitro-server to version 3.21.6 or 4.4.6.
Ensure any intermediary cache keys '/ nuxt island/*' on the full query string rather than the path alone.
Audit application-authored islands to ensure props are not passed into
v-html, innerHTML, or similar HTML sinks, treating island props as untrusted user input.Exploit
Fix
HTTP Request/Response Smuggling
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
@Nuxt/Nitro-Server
Nuxt