ZDF
Sign inSign up

Vulnerabilities

Security fix · GHSA-2fxj-c3j7-rr69

Server island endpoint does not apply route rules to pages

Published Oct 27, 2026 · catalog updated Oct 29, 2026 · Server island endpoint does

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for GHSA-2fxj-c3j7-rr69. A missing EPSS score is not a low risk. Compare Server island endpoint does with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Server island endpoint does).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Awaiting synchronization with FIRST
Remediation
Version ranges on file
Affected products
npm nuxt

### Summary A page is also rendered as a server island at . Nitro applies to the request path, which for an island request is the path rather than the page path, so a route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects. The island hash is derived from the component name, props and context. It is not a secret, so no credentials are needed to construct a valid request. ### Details With the following configuration and a page at : responds with and , but responds with and the rendered page. During client-side navigation, the global middleware applies rules before a page island is fetched. When rendering a page island on the server, that middleware did not run, so nothing applied the page's rule. ### Impact An application is affected only if all of the following are true: - it has a page - a route rule matches that page - it relies on that redirect to keep the page's server-rendered content from being served A route rule applies to every request, so it is not an authentication or authorisation mechanism. Pages that perform their own access checks (for example in route middleware, which runs for page islands since GHSA-hg3f-28rg-4jxj, or in the server endpoints they fetch from) are not affected. Pages that are not are not affected either, as their templates are part of the client bundle. ### Patches Fixed in . When rendering a page island, Nuxt now applies the page's route rule and responds with a redirect instead of rendering the page. Nuxt 3 has reached end of life and will not receive a fix. Upgrade to Nuxt 4. ### Workarounds Protect sensitive server pages with route middleware or server-side checks rather than a route rule, or remove pages that should no longer be served. Alternatively, reject island requests for the affected page with a server middleware:

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm nuxt>= 3.11.0 < 4.6.3

How to fix GHSA-2fxj-c3j7-rr69

  • Upgrade

    GHSA-2fxj-c3j7-rr69 lists a fix boundary at 4.6.3. Compare the installed build with that boundary before you change production.

  • Version check

    Seen in >= 3.11.0 < 4.6.3

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for GHSA-2fxj-c3j7-rr69. A missing EPSS score is not a low risk. Compare Server island endpoint does with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with >= 3.11.0 < 4.6.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-284: Improper Access Control; CWE-424. EPSS is not on this record yet. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · Maintainer security tabs

    Detected

    ### Summary A page is also rendered as a server island at . Nitro applies to the request path, which for an island request is the path rather than the page path, so a route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects. The island hash is derived from the component

  2. Oct 29, 2026 · Maintainer security tabs

    Updated

    ### Summary A page is also rendered as a server island at . Nitro applies to the request path, which for an island request is the path rather than the page path, so a route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects. The island hash is derived from the component

Sources

  • Maintainer security tabsVendor advisoryGHSA-2fxj-c3j7-rr69

    ### Summary A page is also rendered as a server island at . Nitro applies to the request path, which for an island request is the path rather than the page path, so a route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects. The island hash is derived from the component

    github.com

Freshness

Last verified in this catalog Oct 29, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026