NUXT · GHSA-2fxj-c3j7-rr69 · Package
FIX → 4.6.3
A `.server.vue` page is also reachable as a server island endpoint, and the `redirect` route rule configured for its direct URL is not applied to that endpoint. An attacker can request the island URL and receive the server-rendered HTML of a page that the direct route redirects away.
first public Oct 27, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that have a .server.vue page and a redirect route rule matching that page, and that rely on the redirect to keep the page content private. Pages that do their own access checks in route middleware or in the server endpoints they call are not affected, and neither are pages that are not .server.vue. A redirect rule is not an access control, so teams that never relied on it for protection have less exposure.
Not affected if auth-required, no-server-vue-pages, route-middleware-checks
Who cares nuxt, self-hosted, ssr
.server.vue files under app/pages/ or pages/.routeRules in for any rule that matches one of those pages.A .server.vue page is also rendered as a server island at /__nuxt_island/page_<name>_<hash>.json. Nitro applies routeRules to the request path, which for an island request is the /__nuxt_island/... path rather than the page path, so a redirect route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects.
The island hash is derived from the component name, props and context. It is not a secret, so no credentials are needed to construct a valid request.
With the following configuration and a page at app/pages/secret.server.vue:
export default defineNuxtConfig({
routeRules: {
'/secret': { redirect: '/login' },
},
})
GET /secret responds with and , but responds with and the rendered page.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
nuxt.config.tsredirectnpm ls nuxt.Upgrade to 4.6.3
nuxt 4.6.3 (Nuxt 4 line); Nuxt 3 receives no fix, so upgrade to Nuxt 4.307Location: /loginGET /__nuxt_island/page_secret_<hash>.json?url=%2Fsecret200During client-side navigation, the global manifest-route-rule middleware applies redirect rules before a page island is fetched. When rendering a page island on the server, that middleware did not run, so nothing applied the page's redirect rule.
An application is affected only if all of the following are true:
.server.vue pageredirect route rule matches that pageA redirect route rule applies to every request, so it is not an authentication or authorisation mechanism. Pages that perform their own access checks (for example in route middleware, which runs for page islands since GHSA-hg3f-28rg-4jxj, or in the server endpoints they fetch from) are not affected. Pages that are not .server.vue are not affected either, as their templates are part of the client bundle.
Fixed in nuxt@4.6.3. When rendering a page island, Nuxt now applies the page's redirect route rule and responds with a redirect instead of rendering the page.
Nuxt 3 has reached end of life and will not receive a fix. Upgrade to Nuxt 4.
Protect sensitive server pages with route middleware or server-side checks rather than a redirect route rule, or remove pages that should no longer be served.
Alternatively, reject island requests for the affected page with a server middleware:
// server/middleware/block-secret-island.ts
export default defineEventHandler((event) => {
if (event.path.startsWith('/__nuxt_island/page_secret_')) {
throw createError({ statusCode: 404 })
}
})