# CVE-2026-46342: Nuxt cache poisoning and XSS in island component rendering

Source: https://junglewise.ai/threats/cve-2026-46342-nuxt-cache-poisoning-and-xss-in-island-component-rendering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-12. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-46342 · Severity: low · CVSS 3.1 · Published 2026-06-12

Nuxt is a popular web development framework. A vulnerability in how it handles 'island' components—parts of a page that render independently—could allow an attacker to manipulate the content displayed to other users. If the application is behind a caching service like a CDN, an attacker could trick the system into saving a malicious version of a page component, potentially leading to the theft of user data or the execution of unauthorized scripts (XSS).

Technologies: [@nuxt/nitro-server (npm)](https://junglewise.ai/threats/technologies/nuxt-nitro-server), [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2026-46342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46342 being exploited in the wild.

**How severe is CVE-2026-46342?** Low severity, with a CVSS score of 3.1, published 12 June 2026.

**Which products and versions are affected?** @nuxt/nitro-server (npm) SEMVER:introduced=3.20.0,fixed=3.21.6; nuxt (npm) SEMVER:introduced=3.1.0,fixed=3.21.6; Nuxt Nitro Server 3.20.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6.

**Is there a fix for CVE-2026-46342?** Yes. @nuxt/nitro-server (npm): upgrade to 3.21.6 or later; nuxt (npm): upgrade to 3.21.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46342 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-46342?** Check whether you run @nuxt/nitro-server (npm), nuxt (npm) or Nuxt Nitro Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nuxt/nitro-server (npm): upgrade to 3.21.6 or later

  ```sh
  npm install @nuxt/nitro-server@3.21.6
  ```

- nuxt (npm): upgrade to 3.21.6 or later

  ```sh
  npm install nuxt@3.21.6
  ```


## Technical details

The /__nuxt_island/* endpoint accepts attacker-controlled props via query or body parameters but fails to verify the URL-resident hash (<Name>_<hashId>.json) on the server side. Because the hash is only computed client-side, an attacker can provide arbitrary props for a given path. In environments where a CDN or reverse proxy caches these responses based on the URL path alone (ignoring query strings), an attacker can poison the cache with malicious props. If these props flow into unsafe HTML sinks like v-html, this results in stored XSS. The issue is fixed in Nuxt 3.21.6 and 4.4.6 by re-validating the hashId against the provided props on the server.

## Affected products

- Nuxt Nuxt 3.1.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6
- Nuxt @nuxt/nitro-server 3.20.0 to < 3.21.6, 4.0.0-alpha.1 to < 4.4.6

## Identifiers

- CVE-2026-46342
- GHSA-g8wj-3cr3-6w7v

## Timeline

- 2026-05-13: patched: Fix merged in GitHub pull request #35077
- 2026-05-18: advisory: GitHub Security Advisory GHSA-g8wj-3cr3-6w7v published
- 2026-06-12: disclosed: CVE-2026-46342 published to NVD

## References

- [https://github.com/nuxt/nuxt/pull/35077](https://github.com/nuxt/nuxt/pull/35077)
- [https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v](https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v)

## Related threats

- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt case-sensitive route matching bypass](https://junglewise.ai/threats/cve-2026-114132-nuxt-is-an-open-source-web-development-framework-for-vue-js)
- [Nuxt route-rule bypass via percent-encoded segments](https://junglewise.ai/threats/cve-2026-114131-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt XSS via protocol bypass in NuxtLink](https://junglewise.ai/threats/cve-2026-114130-nuxt-is-an-open-source-web-development-framework-for-vue-js)