Nuxt Server Islands Render `useHeadSafe` Input Without Sanitisation

Impact "useHeadSafe" restricts head input to an allowlist of safe tags and attributes. For example, "bodyAttrs" is limited to "class" and "style", event handler attributes are removed, and " Mitigating factors - Server components are experimental. They are only active when the application defines...

EUVD-2026-107417

Nuxt server islands render useHeadSafe input without sanitisation...

GHSA-XFQ5-W38Q-PC2X Nuxt server islands render `useHeadSafe` input without sanitisation

Impact useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and tags are only kept for JSON types. When useHeadSafe is called inside a server island a .server.vue component or page...

Nuxt server islands render `useHeadSafe` input without sanitisation

Impact useHeadSafe restricts head input to an allowlist of safe tags and attributes. For example, bodyAttrs is limited to class and style, event handler attributes are removed, and tags are only kept for JSON types. When useHeadSafe is called inside a server island a .server.vue component or page...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the server island head rendering pipeline in packages/nitro-server/src/runtime/handlers/island.ts, where head entries are serialized without applying the useHeadSafe allowlist. An attacker who can influence...

npm: Nuxt server islands render `useHeadSafe` input without sanitisation

npm: Nuxt server islands render useHeadSafe input without sanitisation vulnerability discovered by ? in WordPress npm nuxt versions = 3.13.0, 4.6.2...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133

The Nuxt web development framework (versions 3.13.0 through 4.6.2 ) contains a vulnerability where the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker. This causes NuxtIsland to subsequently insert that input into the...

Nuxt cross-site scripting vulnerability

Versions Nuxt 3.13.0 through 4.6.2 contain a cross-site scripting vulnerability. This flaw arises because the server-island renderer fails to preserve security input markers when serializing useHeadSafe inputs; as a result, NuxtIsland inserts these inputs into the page’s head section as regular...

PT-2026-120736

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.13.0 through 4.6.1 Description The server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker. Subsequently, NuxtIsland inserts this input into the page head ...

CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...

CVE-2026-39315

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in...

CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe is the composable that Nuxt's own documentation explicitly recommends for rendering user-supplied content in safely. Internally, the hasDangerousProtocol function in packages/unhead/src/plugins/safe.ts decodes HTML...

CVE-2026-31860 Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs...

CVE-2026-31860

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. The acceptDataAttrs...

GHSA-G5XX-PWRP-G3FV Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

Summary useHeadSafe can be bypassed to inject arbitrary HTML attributes, including event handlers, into SSR-rendered tags. This is the composable that Nuxt docs recommend for safely handling user-generated content. Details XSS via data- attribute name injection The acceptDataAttrs function safe.t...