Nuxt Component Islands Middleware Bypass leading to Unauthenticated Access

Vulnerability Overview In Nuxt 4, when is enabled, any file located under is automatically registered as a server component and exposed via the endpoint. Prior to this fix, page components rendered through this endpoint bypassed the route middleware in the SSR renderer. This allowed unauthenticated attackers to directly receive server-rendered HTML by requesting , thereby circumventing route middleware checks. Affected Range All applications meeting the following conditions are vulnerable to this issue: 1. is enabled (enabled by default in Nuxt 4, requires manual activation in Nuxt 3). 2. The application defines one or more files under and registers them as route pages. 3. At least one such page relies on route middleware to enforce authentication/authorization but lacks server-side checks for the page or its data layer. Fix The vulnerability has been patched in and . The Vue Router plugin now executes middleware and redirect handling for islands (i.e., islands derived from files under ). The island handler propagates the response emitted by middleware ( ) and returns an HTTP 400 if the requested does not match the URL resolved by the route component. Non-page island components are unaffected—they continue to render without route middleware, which is by design. POC Code Temporary Workaround If an immediate upgrade is not possible, consider the following measures: Enforce authentication within the page itself rather than relying on route middleware. Use to read the session, and throw (or redirect) if no session is present. This is the recommended pattern for islands. Disable if the application does not use this feature. If the application relies solely on route middleware, intercept the URL prefix at the reverse proxy or server middleware level.

Goal Reached Thanks to every supporter — we hit 100%!

Nuxt Component Islands Middleware Bypass leading to Unauthenticated Access

More from this source