Skip to content
Fencer Intel
low 3.1

CVE-2026-128076 json

Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)

published 11d ago modified 3h ago also EUVD-2026-125627 , GHSA-hf59-9xwc-2g4p

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository nuxt/nuxt. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.

Patch / fix

  • npm nuxt 4.6.4
  • npm @nuxt/nitro-server 4.6.4

Is CVE-2026-128076 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm nuxt
>=4.4.6, <4.6.4
>=3.21.6, <4.0.0
4.6.4
npm @nuxt/nitro-server
>=4.4.6, <4.6.4
>=3.21.6, <4.0.0
4.6.4

Affected products

  • nuxt nuxt
  • @nuxt nitro-server

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of nuxt/nuxt published their own advisory on GitHub. Reviewed sources take precedence over it.