CVE-2026-47200

The record

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.

Affected packages

Related vulnerabilities

• GHSA-hg3f-28rg-4jxj Nuxt's route middleware is not enforced when rendering `.server.vue` pages via… Same vulnerability
• CVE-2026-46342 Nuxt is an open-source web development framework for Vue.js. Also affects @nuxt/nitro-server
• GHSA-g8wj-3cr3-6w7v Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling… Also affects @nuxt/nitro-server
• GHSA-m3q2-p4fw-w38m Cross-site scripting via slot content in Nuxt's head components Also affects nuxt
• GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `` via unsanitised `javascript:` or `data:` URL Also affects nuxt
• GHSA-534h-c3cw-v3h9 Nuxt dev server vite-node IPC socket is world-connectable on Linux Also affects nuxt
• GHSA-mm7m-92g8-7m47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and… Also affects nuxt
• GHSA-c9cv-mq2m-ppp3 Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect… Also affects nuxt