CVE-2026-114133: Nuxt server islands render `useHeadSafe` input without sanitisation
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nuxtto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires an application to pass attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland. The affected behavior is described for Nuxt versions from 3.13.0 until the fix in 4.6.2.
What attacker-controlled content can lead to impact?
An attacker needs to control data supplied to useHeadSafe in one of the affected rendering paths. The server-island response can then cause values normally removed by the allowlist, including event-handler attributes or executable script content, to be inserted into the page head and produce stored cross-site scripting.
How can I identify potentially affected application code?
Review uses of useHeadSafe in .server.vue components and pages, and in components rendered through NuxtIsland. Prioritize any call sites whose input can originate from untrusted or user-controlled stored data.