CVE-2026-46342
Description
Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.
How to fix
- nuxt nuxt3.21.6, 4.4.5 or later
- nuxt nuxt\/nitro-server3.21.6, 4.4.6 or later
- nuxt3.21.6, 4.4.6 or later
- @nuxt/nitro-server3.21.6, 4.4.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nuxt nuxt | 3.1.0 ≤ v < 3.21.6, 4.0.0 ≤ v < 4.4.5 | 3.21.6, 4.4.5 |
| nuxt nuxt\/nitro-server | 3.20.0 ≤ v < 3.21.6, 4.2.0 ≤ v < 4.4.6 | 3.21.6, 4.4.6 |
| nuxtnpm | 3.1.0 ≤ v < 3.21.6, 4.0.0-alpha.1 ≤ v < 4.4.6 | 3.21.6, 4.4.6 |
| @nuxt/nitro-servernpm | 3.20.0 ≤ v < 3.21.6, 4.2.0 ≤ v < 4.4.6 | 3.21.6, 4.4.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.