6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47200

CVE-2026-47200: Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run. This issue has been patched in versions 3.21.6 and 4.4.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47200

CVE-2026-47200:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nuxt	npm	>= 3.11.0, <= 3.21.5	3.21.6
@nuxt/nitro-server	npm	>= 3.20.0, <= 3.21.5	3.21.6
@nuxt/nitro-server	npm	>= 4.2.0, <= 4.4.5	4.4.6
nuxt	npm	>= 4.0.0-alpha.1, <= 4.4.5	4.4.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists due to a combination of two flaws in how Nuxt handles server-side rendered 'island' pages. When a request for a page island (e.g., /__nuxt_island/page_secret) was received, two things went wrong:

In packages/nuxt/src/pages/runtime/plugins/router.ts, the router plugin would detect that it was rendering an island (ssrContext.islandContext was set) and would intentionally skip executing any route middleware associated with the page. This was the primary bypass, as it prevented authentication and authorization checks from running.
In packages/nitro-server/src/runtime/handlers/island.ts, the request handler was designed to only render the component's HTML. It lacked the logic to inspect the server context for a response generated by middleware (such as a redirect to a login page). This meant that even if the first flaw was fixed and middleware did run, this handler would have ignored the middleware's decision and returned the page content, nullifying the security check.

The patch addresses both issues. It modifies the router plugin to specifically identify and run middleware for page-level islands. It also updates the island request handler to check for and honor any responses set by middleware, ensuring that redirects and errors are correctly propagated to the client.

Vulnerable functions

defineNuxtPlugin

packages/nuxt/src/pages/runtime/plugins/router.ts

This function, part of the Nuxt router plugin, contained a condition that incorrectly skipped the execution of all route middleware for any server-rendered island component. The vulnerability is that this check was too broad, and it should not have skipped middleware for components that were entire pages (`.server.vue` files in `pages/`). This allowed an attacker to bypass access control checks by directly requesting the island URL for a protected page.

defineEventHandler

packages/nitro-server/src/runtime/handlers/island.ts

This function is the HTTP handler for `/__nuxt_island/*` requests. It was vulnerable because it would unconditionally render the requested component and return its HTML content, without checking for or respecting any response (like a redirect or an error) that might have been set by a middleware function. This meant that even if middleware had run and denied access, this handler would have ignored that decision and returned the protected content anyway.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.