Validation Issues in Nuxt Framework for Vue.js
CVE-2026-128076
What is CVE-2026-128076?
The Nuxt framework, an open-source tool for developing Vue.js applications, contains a validation issue in versions from 3.21.6 and before 4.0.0, as well as versions 4.4.6 until 4.6.4. A flawed hashing mechanism in the /__nuxt_island path could allow different island-prop combinations to produce identical paths, posing a risk for content substitution or script execution. Specifically, if a crawler accesses a colliding URL before prerendition, it may produce unintended script execution within the application’s origin, particularly where unsafe HTML sinks like v-html are used. This vulnerability is addressed in version 4.6.4, and applications that do not use server components or have no attacker-influenced string props remain unaffected.
Affected Version(s)
nitro-server >= 3.21.6, < 4.0.0 < 3.21.6, 4.0.0
nitro-server >= 4.4.6, < 4.6.4 < 4.4.6, 4.6.4
nuxt >= 3.21.6, < 4.0.0 < 3.21.6, 4.0.0