Vulnerability in Nuxt
CVE-2026-47200
Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (26.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Nuxt — versions >= 3.11.0, < 3.21.6, >= 4.0.0-alpha.1, < 4.4.6
- Nuxt Nuxt\/nitro-Server
Weakness classification (CWE)
References
- github.com/nuxt/nuxt/pull/35092 (Issue Tracking)
- github.com/nuxt/nuxt/security/advisories/GHSA-hg3f-28rg-4jxj (Exploit, Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-47200?
- CVE-2026-47200 is a medium-severity vulnerability in Nuxt, classified under Improper Access Control. CVSS score: 5.3/10. Published 2026-06-12.
- How severe is CVE-2026-47200?
- Medium severity. CVSS v3 base score is 5.3 out of 10.