CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Impact

useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and <script> tags are only kept for JSON types.

When useHeadSafe is called inside a server island (a .server.vue component or page, or a component rendered with <NuxtIsland>), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. <NuxtIsland> then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.

As a result, input that useHeadSafe would normally strip (such as bodyAttrs.onload or executable <script> content) is rendered into the page. If an application passes user-controlled data to useHeadSafe inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.

<!-- components/AuthorMeta.server.vue -->
<script setup lang="ts">
const { data: author } = await useFetch('/api/author')
// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }
useHeadSafe(author.value.head)
</script>

Mitigating factors

• Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders <NuxtIsland>.
• Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called from regular (non-island) components and pages is not affected.

Affected versions

nuxt >=3.13.0, when head support for server islands was introduced. Nuxt 2 is not affected.

Patches

Fixed in [email protected]. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Patched releases apply Unhead's safe input filtering to useHeadSafe entries on the server before they are added to the island response, so islandResponse.head (including what render:island hooks see) only contains input that useHeadSafe allows.

Workarounds

Upgrade to [email protected]. If you cannot upgrade, including on Nuxt 3:

1. Call useHeadSafe with untrusted input from a regular component or page rather than from inside a server island.
2. Alternatively, validate untrusted head input against your own allowlist before passing it to useHeadSafe inside a server island.

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .

Impact

useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and <script> tags are only kept for JSON types.

When useHeadSafe is called inside a server island (a .server.vue component or page, or a component rendered with <NuxtIsland>), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. <NuxtIsland> then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.

As a result, input that useHeadSafe would normally strip (such as bodyAttrs.onload or executable <script> content) is rendered into the page. If an application passes user-controlled data to useHeadSafe inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.

<!-- components/AuthorMeta.server.vue -->
<script setup lang="ts">
const { data: author } = await useFetch('/api/author')
// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }
useHeadSafe(author.value.head)
</script>

Mitigating factors

• Server components are experimental. They are only active when the application defines a .server.vue component or page, or enables experimental.componentIslands and renders <NuxtIsland>.
• Exploitation requires the application to pass attacker-controlled data to useHeadSafe inside a server island. useHeadSafe called from regular (non-island) components and pages is not affected.

Affected versions

nuxt >=3.13.0, when head support for server islands was introduced. Nuxt 2 is not affected.

Patches

Fixed in [email protected]. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.

Patched releases apply Unhead's safe input filtering to useHeadSafe entries on the server before they are added to the island response, so islandResponse.head (including what render:island hooks see) only contains input that useHeadSafe allows.

Workarounds

Upgrade to [email protected]. If you cannot upgrade, including on Nuxt 3:

1. Call useHeadSafe with untrusted input from a regular component or page rather than from inside a server island.
2. Alternatively, validate untrusted head input against your own allowlist before passing it to useHeadSafe inside a server island.

TuxCare rebuilt nuxt to address 3 CVEs. Fixed in 4.0.3-tuxcare.12.