CVE-2026-128076

The fix for CVE-2026-46342 (GHSA-g8wj-3cr3-6w7v) binds each /__nuxt_island/_.json path to its props by hashing the (name, props, context, source) tuple. That hash was computed over ohash's serialization, which does not escape quotes inside strings or delimiters inside keys, so two different prop objects can produce the same hash. A request with crafted props can therefore pass validation for another island's path and render different content at that path.

For example, these two prop objects serialize identically and share one island path:

This reopens the scenarios described in GHSA-g8wj-3cr3-6w7v:

• nuxt generate / prerendering. Nuxt caches prerendered island responses by path. If the crawler reaches a link to the colliding URL (for example in user-submitted content included in the build) before it renders the page that uses the legitimate props, the colliding response is written into the generated page.
• Path-keyed shared caches.