Is CVE-2026-114133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114133 being exploited in the wild.

How severe is CVE-2026-114133?

Medium severity, with a CVSS score of 5.4, published 21 October 2026.

Which products and versions are affected?

nuxt (npm) >= 3.13.0, < 4.6.2, SEMVER:introduced=3.13.0,fixed=4.6.2; Nuxt 3.13.0 to 4.6.1.

Is there a fix for CVE-2026-114133?

Yes. nuxt (npm): upgrade to 4.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114133?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114133: Nuxt stored cross-site scripting in useHeadSafe server island rendering

Q: Is there a fix for CVE-2026-114133?

Yes. nuxt (npm): upgrade to 4.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114133 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114133?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114133 · Severity: medium · CVSS 5.4 · Published 2026-10-21

Nuxt is a web development framework for building Vue.js applications. When handling attacker-controlled data passed to useHeadSafe in server-rendered components, the framework fails to preserve safety markers during serialization, allowing malicious scripts or event handlers to be injected into the page head. This can enable attackers to execute arbitrary JavaScript in users' browsers when visiting an affected application.

Technologies: nuxt (npm), Nuxt. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-114133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114133 being exploited in the wild.
How severe is CVE-2026-114133?: Medium severity, with a CVSS score of 5.4, published 21 October 2026.
Which products and versions are affected?: nuxt (npm) >= 3.13.0, < 4.6.2, SEMVER:introduced=3.13.0,fixed=4.6.2; Nuxt 3.13.0 to 4.6.1.
Is there a fix for CVE-2026-114133?: Yes. nuxt (npm): upgrade to 4.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114133?: Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.6.2 or later
```
npm install nuxt@4.6.2
```

Technical details

The vulnerability exists in the server-island renderer which serializes useHeadSafe input without preserving the safe-input marker; NuxtIsland then treats the data as ordinary entries, bypassing the allowlist that normally prevents event-handler attributes and executable script content. Exploitation requires the application to pass attacker-controlled data to useHeadSafe in a .server.vue component or component rendered through NuxtIsland. The resulting stored XSS executes in the application origin.

Affected products

Nuxt Nuxt 3.13.0 to 4.6.1

Identifiers

CVE-2026-114133
GHSA-xfq5-w38q-pc2x

Timeline

2026-10-21: disclosed
2026-10-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.