CVE-2026-46342

Medium

Advisory

Published 19 May 2026In the index since 8 Sept 2026

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
nuxtnpm	3.10.2, 4.4.2	3.21.6, 4.4.6	2
@nuxt/nitro-servernpm	4.4.2	4.4.6	1

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 4 container images this version deploys carry CVE-2026-46342.

Container image	Digest	Package	Fixed in
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	nuxt@3.10.2	3.21.6

32,501

1 of the 5 container images this version deploys carry CVE-2026-46342.

Container image	Digest	Package	Fixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	@nuxt/nitro-server@4.4.2 nuxt@4.4.2	4.4.6 4.4.6

3,798

2 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	@nuxt/nitro-server@4.4.2 nuxt@4.4.2	4.4.6 4.4.6	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	nuxt@3.10.2	3.21.6	1