Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Description

The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>.

Recommendation

Update the @nuxt/nitro-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.2.0, <= 4.4.5

  >= 3.20.0, <= 3.21.5**

• Patched version(s): **4.4.6

  3.21.6**

References

• GHSA-g8wj-3cr3-6w7v
• CVE-2026-46342
• CWE-349
• CWE-444
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` - CVE-2026-47200
• axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV - CVE-2026-44492
• Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - @strapi/plugin-users-permissions - CVE-2026-22706
• Strapi: Password Reset Does Not Revoke Existing Refresh Sessions - CVE-2026-22706

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@nuxt/nitro-server