CVE-2026-114133 in Nuxt
Summary
by MITRE • 10/21/2026
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the Nuxt web development framework represents a critical failure in input validation and serialization logic during server-side rendering operations. Specifically affecting versions from 3.13.0 through 4.6.2, this flaw resides in the handling of safe head metadata entries managed by the useHeadSafe utility function. In secure implementations, such utilities are designed to sanitize user-provided data before it is injected into the HTML document structure, ensuring that dangerous constructs like event handlers or script tags are stripped out. However, due to a defect in the server-island renderer, raw input provided via useHeadSafe was serialized directly into the island response payload without preserving the necessary safe-input markers that signal downstream components to apply further sanitization checks.
When NuxtIsland processes these responses for insertion into the main page head, it treats the unsanitized data as ordinary content rather than protected input. This architectural oversight allows attacker-controlled values to bypass the application's allowlist mechanisms entirely. Consequently, malicious payloads such as JavaScript event-handler attributes or executable script blocks are rendered directly into the DOM of the victim user's browser session. Because this processing occurs on the server and the resulting HTML is served back to clients, the vulnerability manifests as a stored cross-site scripting issue rather than a reflected one. The persistence of these scripts in the application origin means that any user visiting the affected page will execute the malicious code automatically upon loading.
The operational impact of this vulnerability is severe, enabling attackers to perform session hijacking by stealing authentication cookies or tokens, deface web pages, redirect users to phishing sites, or execute arbitrary actions on behalf of authenticated victims. Since NuxtIsland facilitates dynamic content updates without full page reloads in many modern applications, the attack vector can be triggered repeatedly and efficiently. The lack of proper context preservation during serialization means that even if other parts of the application enforce strict Content Security Policies, this specific pathway circumvents those protections by injecting scripts directly into the head element where they may execute before policy enforcement mechanisms are fully initialized or applied to dynamic content injections.
To mitigate this risk, organizations must immediately upgrade Nuxt to version 4.6.2 or later, which corrects the serialization logic and ensures that safe-input markers are preserved during server-island rendering processes. For applications unable to update immediately due to dependency constraints, a temporary mitigation involves avoiding the use of useHeadSafe with any user-supplied data within .server.vue components or islands rendered via NuxtIsland. Instead, developers should implement manual sanitization using robust libraries that adhere to OWASP guidelines for preventing cross-site scripting before passing data to head management functions. Additionally, enforcing strict Content Security Policies can help limit the impact of successful exploitation by restricting script execution sources and behaviors, although this serves only as a compensating control rather than a fix for the underlying code defect.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves improper validation during data serialization which maps to CWE-20 Incorrect Handling of Input Validation. In terms of adversary tactics, the exploitation technique corresponds to ATT&CK T1059 Command and Control via Application Layer Protocol or potentially T1189 Drive-by Client Side Code Execution depending on how the payload is delivered. The failure lies in the assumption that server-side serialization preserves security contexts, highlighting the need for rigorous testing of data flow across framework boundaries where state and metadata are transferred between client and server components.