{"id":"CVE-2026-128076","summary":"Nuxt: Colliding island props can share one `/__nuxt_island` path (incomplete fix for CVE-2026-46342)","details":"Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.","aliases":["GHSA-hf59-9xwc-2g4p"],"modified":"2026-11-14T02:47:33.962789482Z","published":"2026-11-13T17:38:34.081Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-349"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128076.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128076.json"},{"type":"FIX","url":"https://github.com/nuxt/nuxt/commit/6f1b93c643355688bc9e2d7434723f7fd3f25092"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.4"},{"type":"ADVISORY","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-hf59-9xwc-2g4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128076"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nuxt/nuxt","events":[{"introduced":"1a8fff351be63bdc639a8b0a2f5a9e74dad240c9"},{"fixed":"8aacdde48e8388c8bb11b9a5c2f59935341bfcfd"},{"introduced":"30a45f7bb206a8373b9183e60eb344891a6f5bb8"},{"fixed":"b9a6b687018a87db72832620beec55bf46abd623"},{"fixed":"6f1b93c643355688bc9e2d7434723f7fd3f25092"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"3.21.6"},{"fixed":"4.0.0"}]},{"strategy":"StringRangeExpression","range":[{"introduced":"4.4.6"},{"fixed":"4.6.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"6f1b93c643355688bc9e2d7434723f7fd3f25092"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v4.6.4","range":[{"fixed":"b9a6b687018a87db72832620beec55bf46abd623"}]}]}}],"versions":["v4.6.3","v4.6.2","v4.6.1","v4.6.0","v4.5.0","v4.5.2","v4.5.1","v4.4.8","v4.4.7","v4.4.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128076.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}