ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-114133

Nuxt server islands render input without sanitisation

Published Oct 16, 2026 · catalog updated Oct 29, 2026 · Nuxt server islands render

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-114133. EPSS is 0.22%. Act only if a listed version of Nuxt server islands render is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nuxt server islands render).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.22%
Remediation
Version ranges on file
Affected products
npm nuxt · package npm

## Impact restricts head input to an allowlist of safe tags and attributes. For example, is limited to and , event handler attributes are removed, and tags are only kept for JSON types. When is called inside a server island (a component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the island response without the option that marks it as safe input. then pushes that input into the page's head as a regular entry, both during server rendering and when hydrating or refetching on the client. As a result, input that would normally strip (such as or executable content) is rendered into the page. If an application passes user-controlled data to inside a server island, an attacker who controls that data can achieve stored cross-site scripting on the application's origin. ## Mitigating factors - Server components are experimental. They are only active when the application defines a component or page, or enables and renders . - Exploitation requires the application to pass attacker-controlled data to inside a server island. called from regular (non-island) components and pages is not affected. ## Affected versions , when head support for server islands was introduced. Nuxt 2 is not affected. ## Patches Fixed in . Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix. Patched releases apply Unhead's safe input filtering to entries on the server before they are added to the island response, so (including what hooks see) only contains input that allows. ## Workarounds Upgrade to . If you cannot upgrade, including on Nuxt 3: 1. Call with untrusted input from a regular component or page rather than from inside a server island. 2. Alternatively, validate untrusted head input against your own allowlist before passing it to inside a server island. ## References - [ documentation](https://nuxt.com/docs/4.x/api/composables/use-head-safe) - [Server components documentation](https://nuxt.com/docs/4.x/guide/co

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm nuxt>= 3.13.0 < 4.0.0
  • npm nuxt>= 3.13.0, < 4.6.2
  • npm nuxt>= 4.0.0 < 4.6.2
  • package npmversion unspecified

How to fix CVE-2026-114133

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-114133. EPSS is 0.22%. Act only if a listed version of Nuxt server islands render is installed.

Which versions are affected?

Compare what you have installed with >= 3.13.0 < 4.0.0, >= 3.13.0, < 4.6.2, >= 4.0.0 < 4.6.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-79: Cross-site Scripting (XSS). EPSS 0.22%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 22, 2026 · GitHub Advisory Database

    Detected

    ## Impact restricts head input to an allowlist of safe tags and attributes. For example, is limited to and , event handler attributes are removed, and tags are only kept for JSON types. When is called inside a server island (a component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the island response without the option that marks it

  2. Oct 22, 2026 · GitHub Advisory Database

    Updated

    ## Impact restricts head input to an allowlist of safe tags and attributes. For example, is limited to and , event handler attributes are removed, and tags are only kept for JSON types. When is called inside a server island (a component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the island response without the option that marks it

  3. Oct 29, 2026 · Maintainer security tabs

    Updated

    ## Impact restricts head input to an allowlist of safe tags and attributes. For example, is limited to and , event handler attributes are removed, and tags are only kept for JSON types. When is called inside a server island (a component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the island response without the option that marks it

Sources

  • CVE.orgVulnerability recordCVE-2026-114133

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-114133

    30-day exploitation probability 0.22%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-xfq5-w38q-pc2x

    Nuxt server islands render input without sanitisation

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-114133

    useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and tags are only kept for JSON types. When useHeadSafe is called inside a server island (a .server.vue component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the i

    advisories.gitlab.com
  • Maintainer security tabsVendor advisoryGHSA-xfq5-w38q-pc2x

    ## Impact restricts head input to an allowlist of safe tags and attributes. For example, is limited to and , event handler attributes are removed, and tags are only kept for JSON types. When is called inside a server island (a component or page, or a component rendered with ), the island renderer serialises the raw input of every head entry into the island response without the option that marks it

    github.com
  • Snyk Vulnerability DatabasePackage advisorySNYK-JS-NUXT-21431488

    Cross-site Scripting (XSS)

    security.snyk.io

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • FIRST EPSSOct 31, 2026
  • Snyk Vulnerability DatabaseOct 25, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • CVE.orgOct 23, 2026