{"action":"Upgrade nuxt to 4.6.2 or later.","affected":[{"fixed":"4.6.2","introduced":"3.13.0"}],"component":"nuxt","cve_ids":["CVE-2026-114133"],"ecosystem":"npm","exploited":false,"fixed_versions":["4.6.2"],"ghsa_id":"GHSA-xfq5-w38q-pc2x","id":"tcs_01M5JMDHR85QAMVTNXM2XE978K","modified_at":"2026-10-22T17:15:04.291934160Z","published_at":"2026-10-22T16:58:00Z","references":["https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x","https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x","https://nvd.nist.gov/vuln/detail/CVE-2026-114133","https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0","https://github.com/nuxt/nuxt","https://github.com/nuxt/nuxt/releases/tag/v4.6.2"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-xfq5-w38q-pc2x","url":"https://osv.dev/vulnerability/GHSA-xfq5-w38q-pc2x"}],"summary":"Nuxt server islands render `useHeadSafe` input without sanitisation"}