{"id":"CVE-2026-114133","aliases":["CLSA-2026-1793811511","EUVD-2026-107417","GHSA-xfq5-w38q-pc2x"],"status":"published","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0022,"percentile":0.12712,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-10-21T17:52:09Z","modified":"2026-11-04T19:00:39Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.6.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.13.0"},{"fixed":"4.6.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.12"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.10","4.0.3-tuxcare.11","4.0.3-tuxcare.2","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6","4.0.3-tuxcare.7","4.0.3-tuxcare.8","4.0.3-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.13.0"},{"fixed":"4.6.2"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114133","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xfq5-w38q-pc2x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114133.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-114133","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","status":"published","published":"2026-10-21T17:52:09.381Z","modified":"2026-10-28T17:23:40.538Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:39:50.160666Z"}],"euvd":[{"id":"EUVD-2026-107417","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","status":"published","published":"2026-10-21T17:52:09Z","modified":"2026-10-28T17:23:40Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:19.960148Z"}],"ghsa":[{"id":"GHSA-xfq5-w38q-pc2x","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","description":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `\u003cscript\u003e` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with `\u003cNuxtIsland\u003e`), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `\u003cNuxtIsland\u003e` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `\u003cscript\u003e` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n\u003c!-- components/AuthorMeta.server.vue --\u003e\n\u003cscript setup lang=\"ts\"\u003e\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }\nuseHeadSafe(author.value.head)\n\u003c/script\u003e\n```\n\n## Mitigating factors\n\n- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders `\u003cNuxtIsland\u003e`.\n- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.\n\n## Affected versions\n\n`nuxt` `\u003e=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nPatched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island.\n2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.","status":"published","published":"2026-10-22T16:58:00Z","modified":"2026-10-22T16:58:02Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-114133","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","status":"published","published":"2026-10-21T18:17:26.26Z","modified":"2026-10-28T18:17:10.55Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-114133","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","description":"Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This issue is fixed in version 4.6.2 .","status":"published","published":"2026-10-21T17:52:09.381Z","modified":"2026-10-30T02:31:07.992548856Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:56.310988Z"},{"id":"GHSA-xfq5-w38q-pc2x","title":"Nuxt server islands render `useHeadSafe` input without sanitisation","description":"## Impact\n\n`useHeadSafe` restricts head input to an allowlist of safe tags and attributes. For example, `bodyAttrs` is limited to `class` and `style`, event handler attributes are removed, and `\u003cscript\u003e` tags are only kept for JSON types.\n\nWhen `useHeadSafe` is called inside a server island (a `.server.vue` component or page, or a component rendered with `\u003cNuxtIsland\u003e`), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. `\u003cNuxtIsland\u003e` then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client.\n\nAs a result, input that `useHeadSafe` would normally strip (such as `bodyAttrs.onload` or executable `\u003cscript\u003e` content) is rendered into the page. If an application passes user-controlled data to `useHeadSafe` inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin.\n\n```vue\n\u003c!-- components/AuthorMeta.server.vue --\u003e\n\u003cscript setup lang=\"ts\"\u003e\nconst { data: author } = await useFetch('/api/author')\n// author.value.head is user-authored, e.g. { bodyAttrs: { onload: '...' } }\nuseHeadSafe(author.value.head)\n\u003c/script\u003e\n```\n\n## Mitigating factors\n\n- Server components are experimental. They are only active when the application defines a `.server.vue` component or page, or enables `experimental.componentIslands` and renders `\u003cNuxtIsland\u003e`.\n- Exploitation requires the application to pass attacker-controlled data to `useHeadSafe` inside a server island. `useHeadSafe` called from regular (non-island) components and pages is not affected.\n\n## Affected versions\n\n`nuxt` `\u003e=3.13.0`, when head support for server islands was introduced. Nuxt 2 is not affected.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nPatched releases apply Unhead's safe input filtering to `useHeadSafe` entries on the server before they are added to the island response, so `islandResponse.head` (including what `render:island` hooks see) only contains input that `useHeadSafe` allows.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Call `useHeadSafe` with untrusted input from a regular component or page rather than from inside a server island.\n2. Alternatively, validate untrusted head input against your own allowlist before passing it to `useHeadSafe` inside a server island.","status":"published","published":"2026-10-22T16:58:00Z","modified":"2026-10-22T17:15:04.29193416Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1793811511","title":"TuxCare security update for nuxt (3 CVEs)","description":"TuxCare rebuilt nuxt to address 3 CVEs. Fixed in 4.0.3-tuxcare.12.","status":"published","published":"2026-11-04T17:58:32Z","modified":"2026-11-04T19:00:39.844850976Z","updated_at":"2026-11-04T19:15:03.6858Z"}]}}