Answer in brief
CVE-2026-128076 records a Low severity (CVSS 3.1) vulnerability in Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342). The current sources do not mark it as known exploited. The current feed maps @nuxt/nitro-server (generic), nuxt/nuxt (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps @nuxt/nitro-server (generic), nuxt/nuxt (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| @nuxt/nitro-servergeneric | >=3.21.6 <4.0.0 || >=4.4.6 <4.6.4 | 4.0.0, 4.6.4 |
| nuxt/nuxtgeneric | >=3.21.6 <4.0.0 || >=4.4.6 <4.6.4 | 4.0.0, 4.6.4 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.
Quoted source text, attributed separately from HOL analysis.