CVE-2026-47200: Nuxt Component Islands Route Middleware Bypass

Technical summary

The vulnerability exists in how Nuxt's experimental Component Islands feature (enabled by default in Nuxt 4) automatically registers .server.vue files located in the pages/ directory as server islands. These components are exposed via the /__nuxt_island/:name endpoint. The flaw is that requests to this endpoint bypass Vue Router instantiation entirely, which means route-level middleware—declared via definePageMeta({ middleware })—never executes. This circumvents authentication, authorization, and other security checks that developers expected to enforce on those routes. The SSR renderer directly renders the page component without the security context that middleware provides.

Business impact

Organizations using Nuxt with Component Islands enabled face information disclosure risk. Attackers can directly access page components that contain sensitive data or logic, bypassing authentication middleware and authorization checks. This could expose customer data, business logic, or other protected information without leaving normal request patterns in logs. The risk is particularly acute for applications that rely on middleware for compliance controls (PCI-DSS, HIPAA, GDPR) or that serve regulated data. Development teams must patch quickly to avoid potential data breach liability.

Affected systems

Nuxt framework versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5 are vulnerable. The @nuxt/nitro-server package in the same version ranges is also affected, as it provides the server-side rendering backend. Nuxt 4 users are at elevated risk because Component Islands is enabled by default. Nuxt 3 users who have explicitly enabled experimental.componentIslands are also at risk. Any application serving .server.vue files in the pages/ directory with this feature enabled and deployed to production requires immediate attention.

Exploitability

Exploitation requires no authentication and no special user interaction. An attacker simply needs to know or guess the route name of a .server.vue page component; the endpoint /__nuxt_island/:name is unauthenticated and publicly accessible. Route names in many applications can be inferred from directory structure or discovered through directory enumeration. The attack surface is network-accessible by default. While this is not currently listed in the CISA KEV catalog, the simplicity of exploitation and lack of barriers to access make it a credible threat for public-facing applications.

Remediation

Upgrade Nuxt to version 3.21.6 or later (for 3.x users) or version 4.4.6 or later (for 4.x users). For @nuxt/nitro-server, apply the same version boundaries. If immediate patching is not feasible, disable the experimental.componentIslands feature by setting it to false in nuxt.config.ts, then restart your application. Audit logs and access patterns for any signs of unauthorized requests to /__nuxt_island/ endpoints prior to patching.

Patch guidance

Verify the exact version of Nuxt and @nuxt/nitro-server in your package.json and lock files. Upgrade Nuxt to 3.21.6+ or 4.4.6+ depending on your major version line. Update @nuxt/nitro-server to match. Run npm audit after upgrading to confirm no regressions. Test your application in a staging environment, especially any pages that use definePageMeta({ middleware }), to confirm middleware is now invoked correctly through the island endpoint. If you have pinned versions, unpin them or explicitly set the new minimum versions.

Detection guidance

Monitor access logs for requests to /__nuxt_island/ endpoints, particularly those matching known page route names. Baseline normal island requests and alert on unusual patterns or authentication-free access to sensitive routes. Review web application firewall (WAF) logs for anomalous access to this endpoint. Scan your codebase for .server.vue files in pages/ directories and audit their middleware declarations. Check production deployments to confirm which versions of Nuxt and @nuxt/nitro-server are currently running.

Why prioritize this

Although the CVSS score is moderate (5.3), the simplicity of exploitation, default enablement in Nuxt 4, and potential for information disclosure warrant rapid patching. Organizations running Nuxt 4 in production should prioritize this within days rather than weeks. Nuxt 3 users with Component Islands explicitly enabled should also prioritize. The risk is heightened for applications handling regulated or sensitive data.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects low attack complexity, network accessibility, and low confidentiality impact. No authentication is required and user interaction is not necessary. However, the scope is unchanged and there is no integrity or availability impact. The score does not fully capture the reputational and compliance risk of exposed sensitive data, so organizations should consider business context when deciding urgency. The lack of a public exploit in KEV does not diminish the straightforward nature of the flaw.

Frequently asked questions