CVE-2026-46342: Nuxt cache poisoning and XSS in island component rendering

CVE-2026-46342 · Severity: low · CVSS 3.1 · Published 2026-06-12

Nuxt is a popular web development framework. A vulnerability in how it handles 'island' components—parts of a page that render independently—could allow an attacker to manipulate the content displayed to other users. If the application is behind a caching service like a CDN, an attacker could trick the system into saving a malicious version of a page component, potentially leading to the theft of user data or the execution of unauthorized scripts (XSS).

Technologies: @nuxt/nitro-server (npm), nuxt (npm). Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-46342 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46342 being exploited in the wild.
How severe is CVE-2026-46342?
Low severity, with a CVSS score of 3.1, published 12 June 2026.
Which products and versions are affected?
@nuxt/nitro-server (npm) SEMVER:introduced=3.20.0,fixed=3.21.6; nuxt (npm) SEMVER:introduced=3.1.0,fixed=3.21.6; Nuxt Nitro Server 3.20.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6.
Is there a fix for CVE-2026-46342?
Yes. @nuxt/nitro-server (npm): upgrade to 3.21.6 or later; nuxt (npm): upgrade to 3.21.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46342 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46342?
Check whether you run @nuxt/nitro-server (npm), nuxt (npm) or Nuxt Nitro Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nuxt/nitro-server (npm): upgrade to 3.21.6 or later
    npm install @nuxt/nitro-server@3.21.6
  • nuxt (npm): upgrade to 3.21.6 or later
    npm install nuxt@3.21.6

Technical details

The /__nuxt_island/* endpoint accepts attacker-controlled props via query or body parameters but fails to verify the URL-resident hash (<Name>_<hashId>.json) on the server side. Because the hash is only computed client-side, an attacker can provide arbitrary props for a given path. In environments where a CDN or reverse proxy caches these responses based on the URL path alone (ignoring query strings), an attacker can poison the cache with malicious props. If these props flow into unsafe HTML sinks like v-html, this results in stored XSS. The issue is fixed in Nuxt 3.21.6 and 4.4.6 by re-validating the hashId against the provided props on the server.

Affected products

  • Nuxt Nuxt 3.1.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6
  • Nuxt @nuxt/nitro-server 3.20.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6

Identifiers

  • CVE-2026-46342
  • GHSA-g8wj-3cr3-6w7v

Timeline

  • 2026-05-13: patched: Fix merged in GitHub pull request #35077
  • 2026-05-18: advisory: GitHub Security Advisory GHSA-g8wj-3cr3-6w7v published
  • 2026-06-12: disclosed: CVE-2026-46342 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.