Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been patched in versions 3.21.6 and 4.4.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-46342 Server-Side Request Forgery in Nuxt Framework Versions 3.1.0 to 3.21.5 and 4.0.0-alpha.1 to 4.4.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-46342
Post summary
The text announces a Server‑Side Request Forgery vulnerability affecting Nuxt Framework versions 3.1.0 to 3.21.5 and 4.0.0‑alpha.1 to 4.4.5.
CVE-2026-46342 Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions… https://www.cve.org/CVERecord?id=CVE-2026-46342
Post summary
The post merely links to the CVE record and notes the vulnerable Nuxt version ranges, offering no further detail about exploitation, mitigation, or technical specifics.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nuxt | nuxt | - | - | - |
| App | nuxt | nuxt\/nitro-server | - | node.js | - |