Executive brief
Nuxt is a popular web development framework. A vulnerability in its 'server islands' feature allows an attacker to force the server to render unintended components or HTML elements by manipulating data sent to a specific internal endpoint. This could lead to unauthorized data exposure or the injection of malicious content like iframes into the application's pages.
Technical details
The vulnerability exists in the Nuxt server island implementation where props accepted via the '/__nuxt_island/' endpoint are forwarded to Vue dynamic resolution sinks such as <component :is>, resolveDynamicComponent, or h(). An attacker can provide a string value (e.g., via the 'as' prop) that resolves to a globally registered component or a native HTML tag like <iframe>. This occurs because Nuxt does not sufficiently validate that the provided prop is a legitimate component definition rather than an arbitrary string. The issue is particularly prevalent when using polymorphic components from libraries like @nuxt/ui that use attribute fallthrough. Patches have been released to reject top-level 'as' props at the island endpoint.
Affected products
- Nuxt Nuxt >= 3.1.0, < 3.21.10; >= 4.0.0, < 4.5.1
Timeline
- 2026-07-27: disclosed
- 2026-08-05: advisory
- 2026-08-05: patched