← Vulnerability feed

Vulnerability record · CVE-2026-47200 · published 12 June 2026

CVE-2026-47200: Nuxt improper access control vulnerability

Nuxt · Nuxt

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.

6.3 CVSS 4.0 Medium EPSS 0.35% · top 74.0% CWE-284 · Improper access controlCWE-288 · Authentication bypass via alternate path
6.3CVSS 4.0 base score
0.35%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/nuxt/nuxt/pull/35092 Issue Tracking
https://github.com/nuxt/nuxt/security/advisories/GHSA-hg3f-28rg-4jxj ExploitPatchVendor Advisory
https://github.com/nuxt/nuxt/security/advisories/GHSA-hg3f-28rg-4jxj ExploitPatchVendor Advisory

Track CVE-2026-47200 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-3224Nuxt code injection before 3.5.3Nuxt versions prior to 3.5.3 contain a code injection flaw (CWE-94) in the nuxt/nuxt repository. Because the injected code executes in the applicatio…EPSS 59%analysed8.8CVE-2026-53721Nuxt incorrect authorization vulnerabilityNuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule m…EPSS 0.51%8.8CVE-2024-34344Nuxt code injection vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `p…EPSS 0.83%8.8CVE-2024-23657Nuxt path traversal vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on t…EPSS 1.2%7.5CVE-2025-27415Nuxt vulnerabilityNuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is poss…EPSS 0.38%7.5CVE-2024-42352Nuxt server-side request forgery (ssrf) vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client …EPSS 0.65%6.8CVE-2026-56301Nuxt incorrect default permissions vulnerabilityNuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstr…EPSS 0.15%6.1CVE-2024-34343Nuxt cross-site scripting vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockt…EPSS 0.44%

Source: NIST National Vulnerability Database (record CVE-2026-47200), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.