CVE-2026-128076: Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)
Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /nuxtisland path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.4
Event History
Frequently Asked Questions
Which deployments are realistically affected?
Affected versions are Nuxt 3.21.6 through before 4.0.0, and Nuxt 4.4.6 through before 4.6.4, but only where server components or NuxtIsland are used. Islands without attacker-influenced string props are unaffected.
What must an attacker do to exploit this?
An attacker needs to construct different island-prop tuples that collide on the same /__nuxt_island path. For prerendered content, the crawler must reach the colliding URL before the page is rendered with legitimate props; for cached responses, a CDN or reverse proxy must cache island responses by path alone and be primed with the colliding response.
When can this become script execution rather than content substitution?
Script execution is possible only if the substituted prop reaches an unsafe HTML sink such as v-html or innerHTML. Otherwise, the stated impact is content substitution.
What can be done if upgrading is not immediately possible?
Avoid caching island responses solely by path in CDNs or reverse proxies, and prevent attacker-influenced string props from reaching NuxtIsland or server-component islands. Review uses of v-html, innerHTML, and other unsafe HTML sinks that could consume substituted props.
How can I determine whether caching increases my exposure?
Review CDN and reverse-proxy cache-key configuration for /__nuxt_island responses. Exposure from the caching scenario requires those responses to be keyed by path alone; responses not cached this way are unaffected by that scenario.