The vulnerability allows an attacker to issue requests to the /__nuxt_island/<name> endpoint for .server.vue pages that bypass the page’s defined middleware. Because the SSR renderer serves the component without initializing Vue Router, any authentication, logging, or pre‑processing middleware declared via definePageMeta({ middleware }) is skipped. This can let an attacker lift access controls or execute code paths that were intended to be protected, thereby compromising confidentiality and integrity of the application state.

Nuxt version 3.11.0 up to and excluding 3.21.6 and Nuxt 4.0.0‑alpha.1 up to and excluding 4.4.6, as well as @nuxt/nitro‑server versions 3.20.0 up to and excluding 3.21.6 and 4.0.0‑alpha.1 up to and excluding 4.4.6. These releases expose server‑island endpoints that do not enforce route middleware.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is below 1%, suggesting the likelihood of exploitation is low at this time, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote network request to the /__nuxt_island endpoint, which means an attacker only needs internet access or access to the application front‑end to exploit it. The impact is confined to routes with problematic middleware; however, if such routes implement authentication checks, the resulting bypass could expose sensitive application paths or data. The patch resolves the issue by reintegrating the middleware checks during SSR rendering. Until patched, mitigation should focus on limiting access to the exposed endpoint or disabling the experimental componentIslands feature.