CVE-2026-114133

npm/nuxt CVE-2026-114133: medium 5.4

Nuxt server islands render `useHeadSafe` input without sanitisation

Action: Upgrade nuxt to 4.6.2 or later.

npm i nuxt@4.6.2

Affected

Fixed versions

Sources

• osv: GHSA-xfq5-w38q-pc2x
• https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x
• https://nvd.nist.gov/vuln/detail/CVE-2026-114133
• https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0
• https://github.com/nuxt/nuxt
• https://github.com/nuxt/nuxt/releases/tag/v4.6.2

CVE-2026-114133 · published 2026-10-22T16:58:00Z · modified 2026-10-22T17:15:04.291934160Z · JSON