CVE-2026-128076
Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)
- Low 3.1
Description
Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- GitHub_M
- EPSS
- 0.116% likely to be exploited in the next 30 days, higher than 1.675% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 3.1CVSS 3.1, Lowfrom the CNA (GitHub_M)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nuxt | nuxt |
|
| @nuxt | nitro-server |
|
Timeline
- 13 Nov 2026 Published