CVE-2026-114133: Stored Cross-Site Scripting via useHeadSafe in Nuxt Server Islands

Vulnerability ID: CVE-2026-114133
CVSS Score: 5.4
Published: 2026-10-22

A Stored Cross-Site Scripting (XSS) vulnerability exists in Nuxt Server Island rendering logic when utilizing the useHeadSafe composable. Raw head attributes bypass sanitization during island serialization.

TL;DR

Nuxt Server Islands fail to preserve safe-input flags during serialization, bypassing useHeadSafe checks and enabling Stored XSS.

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 5.4 (Medium)
• EPSS Score: 0.00176 (0.18%)
• Impact: Stored Cross-Site Scripting (XSS)
• Exploit Status: None / No active weaponized code in the wild
• CISA KEV Status: Not Listed

Affected Systems

• Nuxt framework applications using Server Islands (.server.vue or )
• Nuxt applications utilizing useHeadSafe with dynamic parameters in Server Components
• nuxt: >= 3.13.0, < 4.6.2 (Fixed in: 4.6.2)

Code Analysis

Commit: 493565e

fix(nitro): sanitize island head input when using useHeadSafe

Mitigation Strategies

• Upgrade framework dependencies to Nuxt 4.6.2 or higher.
• Validate and sanitize untrusted input before passing values into head composables.
• Implement a strong Content Security Policy (CSP) restricting inline script execution.

Remediation Steps:

1. Update nuxt package in package.json to ^4.6.2.
2. Run package manager update command (pnpm update nuxt, npm update nuxt, or yarn upgrade nuxt).
3. Audit all .server.vue components and NuxtIsland usages for user input inputs in useHeadSafe.

References

• GitHub Security Advisory GHSA-xfq5-w38q-pc2x
• Fix Commit in nuxt/nuxt Repository
• Nuxt Framework Release v4.6.2
• NVD CVE-2026-114133 Detail
• CVE.org CVE-2026-114133 Record

Read the full report for CVE-2026-114133 on our website for more details including interactive diagrams and full exploit analysis.