CVE-2026-114133

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Nuxt.js Server-Island Renderer

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114133

EUVD

EUVD-2026-107417

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	>= 3.13.0, < 4.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nuxt, a Vue.js framework, where server-island components improperly handle useHeadSafe input. From versions 3.13.0 to 4.6.2, raw input is serialized without sanitization, allowing malicious attributes like event handlers or script tags to bypass security restrictions. This can lead to stored cross-site scripting (XSS) attacks if attacker-controlled data is passed to useHeadSafe in server components.

Detection Guidance

Check Nuxt.js version with `npm list nuxt` or `yarn list nuxt`. If version is >=3.13.0 and <4.6.2, the system is vulnerable. Inspect server island components (.server.vue) or NuxtIsland usage for useHeadSafe calls with user-controlled input.

Impact Analysis

If exploited, this vulnerability could allow attackers to inject malicious scripts or event handlers into your web application. This could lead to unauthorized actions on behalf of users, data theft, or defacement of your site. Exploitation requires attacker-controlled data passed to useHeadSafe within server island components, which are only active when using .server.vue files or NuxtIsland with experimental islands enabled.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Stored XSS attacks may expose sensitive user data, resulting in non-compliance with these regulations and potential legal consequences.

Mitigation Strategies

Upgrade Nuxt.js to version 4.6.2 or later. Avoid passing attacker-controlled data to useHeadSafe in server island components. Validate all inputs before using useHeadSafe in .server.vue files or NuxtIsland components.

Hi! I’m here to help you understand CVE-2026-114133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...