CVE-2026-114133: Stored Cross-Site Scripting via useHeadSafe in Nuxt Server Islands

Nuxt versions from 3.13.0 up to (but excluding) 4.6.2 contain a Stored Cross-Site Scripting (XSS) flaw classified under CWE-79. The vulnerability exists within Nuxt's Server Island rendering subsystem, specifically in the component head serialization layer handled by the Nitro server runtime.

Nuxt Server Islands enable developers to render standalone components independently on the server using components like <NuxtIsland> or .server.vue source files. These components often collect document head metadata via composables such as useHeadSafe to inject dynamically defined attributes into the client HTML document.

When untrusted user input is passed through useHeadSafe inside a server island component, the server rendering runtime omits the safe input filtering stage. Consequently, unsafe HTML attributes and event handlers bypass validation and are serialized directly into the server response JSON, executing in the context of the user browser upon client-side hydration.

The root cause resides in the head metadata aggregation logic implemented in packages/nitro-server/src/runtime/handlers/island.ts. Unhead provides useHeadSafe to restrict dynamic metadata input to an allowlist of harmless attributes, internally flagging entries with _safe: true to invoke the SafeInputPlugin during tag resolution.

During server island processing, the Nitro server runtime extracts entries from ssrContext.head.entries. The server handler resolves reactive inputs using walkResolver(entry.input, VueResolver) and directly iterates over the resulting dictionary to assemble the output islandHead object.

In affected versions, the handler neglects to check whether entry.options?._safe is configured on the incoming head entry. As a consequence, the runtime skips invocation of @unhead/vue's SafeInputPlugin, leaving malicious attributes (such as onload or inline <script> contents) intact inside the generated JSON response payload.

In affected versions of packages/nitro-server/src/runtime/handlers/island.ts, the renderIsland function processed head metadata without invoking input sanitization filtering rules:

// Vulnerable code path in island.ts
const input = walkResolver(entry.input, VueResolver) as SerializableHead
for (const [key, value] of Object.entries(input)) {
  // Head properties merged directly without checking entry.options?._safe
}

The fix introduced in commit 493565e99451a0f52330b1f6b979254a4a39e5d0 adds dedicated sanitization logic in packages/nitro-server/src/runtime/utils/island-head.ts via toSafeHeadInput():

// Patched logic in island.ts
const input = walkResolver(entry.input, VueResolver) as SerializableHead
for (const [key, value] of Object.entries(entry.options?._safe ? toSafeHeadInput(input) : input)) {
  // Process sanitized head entries
}

The helper function toSafeHeadInput instantiates a server-side Unhead instance with SafeInputPlugin, registers the input with { _safe: true }, and evaluates resolveTags(head) to strip disallowed event handlers and script tags before serializing the final island response.

Exploitation requires an application pattern where user-supplied input is rendered inside a Nuxt Server Island component using the useHeadSafe composable. An authenticated user or attacker submits malicious attribute data stored in the application backend.

Consider a server island component UserProfile.server.vue that sets metadata based on user preferences:

<script setup lang="ts">
const props = defineProps<{ userStyle: string }>()
useHeadSafe({
  bodyAttrs: {
    class: 'user-profile',
    onload: props.userStyle // Attacker value: "alert(document.cookie)"
  }
})
</script>

When a victim navigates to the target page, the server renders the island component and generates an HTTP response containing raw JSON metadata with the unsanitized onload handler. When the client runtime processes the payload, the script executes automatically in the origin context.

The vulnerability yields Stored Cross-Site Scripting with a CVSS v3.1 score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Successful execution allows attackers to run arbitrary client-side JavaScript within the origin session of visiting users.

Impact includes session token extraction, session hijacking, defacement, and unauthorized actions executed on behalf of affected users. The scope change (S:C) reflects the execution of injected JavaScript within the victim browser DOM context.

Currently, EPSS score stands at 0.00176 (0.18th percentile), and CISA KEV does not list active exploitation in the wild. However, applications rendering user input inside Server Islands are directly exposed until updated.

Maintainers resolved the flaw in Nuxt release version 4.6.2. Application teams must upgrade dependencies across affected packages to version 4.6.2 or higher.

Execute dependency updates using the primary package manager:

# pnpm
pnpm update nuxt@^4.6.2
 
# npm
npm install nuxt@^4.6.2
 
# yarn
yarn add nuxt@^4.6.2

In addition to upgrading, enforce strict input sanitization prior to passing user control data into framework composables. Implement a strict Content Security Policy (CSP) with nonces or strict script-src rules to restrict execution of inline scripts.