Description
When experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint.
Recommendation
Update the @nuxt/nitro-server package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.2.0, <= 4.4.5 >= 3.20.0, <= 3.21.5** Patched version(s): **4.4.6 3.21.6**
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning - CVE-2026-46342
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
You might also like:
See something that needs correcting? Let us knowUpdated July 08, 2026