---
id: "GHSA-2fxj-c3j7-rr69"
page: "https://infrastack.ai/live/GHSA-2fxj-c3j7-rr69"
kind: "vulnerability"
aliases: ["GHSA-2fxj-c3j7-rr69"]
title: "Server island endpoint does not apply `redirect` route rules to `.server.vue` pages"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nuxt", "note": ">= 3.11.0 < 4.6.3", "fixed": ["4.6.3"], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-284", "cwe-424", "nuxt", "package", "self-hosted", "ssr"]
not_affected_if: ["auth-required", "no-server-vue-pages", "route-middleware-checks"]
published_at: "2026-10-27T01:10:09+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:57:21+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-2fxj-c3j7-rr69", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# Server island endpoint does not apply `redirect` route rules to `.server.vue` pages

Link for people: https://infrastack.ai/live/GHSA-2fxj-c3j7-rr69 (this .md is for agents)

A `.server.vue` page is also reachable as a server island endpoint, and the `redirect` route rule configured for its direct URL is not applied to that endpoint. An attacker can request the island URL and receive the server-rendered HTML of a page that the direct route redirects away.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nuxt affected range not listed fixed 4.6.3

## How to check

- Look for `.server.vue` files under `app/pages/` or `pages/`.
- Check `routeRules` in `nuxt.config.ts` for any `redirect` rule that matches one of those pages.
- Check the installed version with `npm ls nuxt`.

## Fix

- `nuxt` `4.6.3` (Nuxt 4 line); Nuxt 3 receives no fix, so upgrade to Nuxt 4.

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-2fxj-c3j7-rr69

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-2fxj-c3j7-rr69

## From the sources

### Summary

A `.server.vue` page is also rendered as a server island at `/__nuxt_island/page_<name>_<hash>.json`. Nitro applies `routeRules` to the request path, which for an island request is the `/__nuxt_island/...` path rather than the page path, so a `redirect` route rule configured for the page is not applied to its island. A client can request the page island directly and receive the server-rendered HTML of a page whose direct route redirects.

The island hash is derived from the component name, props and context. It is not a secret, so no credentials are needed to construct a valid request.

### Details

With the following configuration and a page at `app/pages/secret.server.vue`:

```ts
export default defineNuxtConfig({
  routeRules: {
    '/secret': { redirect: '/login' },
  },
})
```

`GET /secret` responds with `307` and `Location: /login`, but `GET /__nuxt_island/page_secret_<hash>.json?url=%2Fsecret` responds with `200` and the rendered page.

During client-side navigation, the global `manifest-route-rule` middleware applies `redirect` rules before a page island is fetched. When rendering a page island on the server, that middleware did not run, so nothing applied the page's `redirect` rule.

### Impact

An application is affected only if all of the following are true:

- it has a `.server.vue` page
- a `redirect` route rule matches that page
- it relies on that redirect to keep the page's server-rendered content from being served

A `redirect` route rule applies to every request, so it is not an authentication or authorisation mechanism. Pages that perform their own access checks (for example in route middleware, which runs for page islands since GHSA-hg3f-28rg-4jxj, or in the server endpoints they fetch from) are not affected. Pages that are not `.server.vue` are not affected either, as their templates are part of the client bundle.

### Patches

Fixed in `nuxt@4.6.3`. When rendering a page island, Nuxt now applies the page's `redirect` route rule and responds with a redirect instead of rendering the page.

Nuxt 3 has reached end of life and will not receive a fix. Upgrade to Nuxt 4.

### Workarounds

Protect sensitive server pages with route middleware or server-side checks rather than a `redirect` route rule, or remove pages that should no longer be served.

Alternatively, reject island requests for the affected page with a server middleware:

```ts
// server/middleware/block-secret-island.ts
export default defineEventHandler((event) => {
  if (event.path.startsWith('/__nuxt_island/page_secret_')) {
    throw createError({ statusCode: 404 })
  }
})
```

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_