Packages / nuxt / Security

LowVulnerabilityGHSA-g8wj-3cr3-6w7vPublished 19 May 2026

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Affected · nuxt

  • >= 3.1.0, < 3.21.6
  • >= 4.0.0-alpha.1, < 4.4.6

Fixed in

4.4.6

npm install nuxt@4.4.6

  1. Not affected

    0.0.1 – 3.0.0

    164 releases

  2. Affected

    3.1.0 – 3.21.5

    85 releases

  3. Fixed

    3.21.6 – 3.21.11

    6 releases

  4. Affected

    4.0.0 – 4.4.5

    16 releases

  5. Fixed

    4.4.6 – 4.6.2

    9 releases, latest

280 stable releases of nuxt, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.