Live › vulnerability › GHSA-9473-5f9j-94wq
Go to dashboardNuxt Server Islands accept component names and props from remote requests without authentication. An attacker can use those parameters to run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC. All times on this page are UTC.
Applications that use Nuxt Server Islands and expose their endpoints to remote requests are exposed. Sites that do not use Server Islands, or that are fully static, are unlikely to be affected. Exact affected Nuxt versions are unknown in the sources.
No product ranges from the sources yet.
<NuxtIsland> or server island components).npm ls nuxt and compare it with the fixed version listed in the advisory (unknown in the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-07-29 · Changelog
New updates and improvements at Cloudflare.
July 29, 2026
This release introduces new rules and updates existing threat signatures to provide targeted protections for vulnerabilities in Nuxt Server Island components and Alibaba Fastjson deserialization routines, alongside enhanced protections for cloud metadata Server-Side Request Forgery (SSRF) and obfuscated command injection attempts.
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...c2e84e2d | N/A | SSRF - Cloud - Beta | Log | Block | This is an improved detection. |
| Cloudflare Managed Ruleset | ...761e7a4c | N/A | Command Injection - Obfuscation | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...7347c892 | N/A | Alibaba Fastjson JSONType Remote Code Execution - Body | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...8ec012ea | N/A | Nuxt Server Island - RCE | N/A | Block | This is a new detection.This was labeled as Generic Rules - RCE. |
| Cloudflare Managed Ruleset | ...3590a4ad | N/A | Generic Rules - RCE | N/A | Block |
This page as .md · .json · in your agent: get_signal("GHSA-9473-5f9j-94wq")
| This is a new detection. |
| Cloudflare Managed Ruleset | ...9c6dff1c | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...3a5b40d6 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |
| Cloudflare Free Ruleset | ...cfe1a93c | N/A | Generic Rules - RCE | N/A | Block | This is a new detection. |
| Cloudflare Free Ruleset | ...9ab5ed95 | N/A | Generic Rules - XSS | N/A | Block | This is a new detection. |
| Cloudflare Free Ruleset | ...1b7f9c67 | N/A | File Upload - RCE | N/A | Block | This is a new detection. |