By weakness (CWE)

CWE-349: related vulnerabilities

CVEs classified under CWE-349. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-46342MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a vulnerability in its island component rendering system that allows attackers to manipulate server responses by crafting malicious requests. The vulnerability exists because the framework computes a security hash client-side but never validates it server-side, meaning an attacker can request the same endpoint with different parameters and receive unintended responses. This could enable attackers to conduct XSS attacks or retrieve sensitive information if islands expose data meant for other users. The issue affects Nuxt 3.1.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the associated @nuxt/nitro-server package.