From 7aff0ffa2e35a99e11e888b05fa7927a4fb75e29 Mon Sep 17 00:00:00 2001
From: brillout <claude@brillout.com>
Date: Fri, 14 Aug 2026 10:04:18 +0000
Subject: [PATCH 01/10] fix(vike-react-zustand): transfer SSR store state via
 <script type="application/json"> (#3463)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of embedding the serialized store state inside an executable,
single-quoted JavaScript string literal — which broke out on a single
quote (e.g. a user name like `O'Brien`), crashing the page and enabling
XSS (#3463) — inject it as the `textContent` of an inert
`<script type="application/json">` block.

Because the payload is never parsed as JavaScript, the whole class of
JS-string-literal escaping disappears: the only sensitive character is
`<` (so the HTML parser can't encounter `</script>`/`<!--` inside the
block), and `htmlScriptSafe` already escapes it transparently for
`parse()`.

An adjacent registrar `<script>` runs synchronously at parse time and
reads its own data block via `previousElementSibling` (the same mechanism
vike-react-query uses), so the client stays exactly as before: the
`globalThis._vikeReactZustandState[key]` map is still populated at parse
time and `assignServerStateOptional()` is unchanged. Only the server-side
injection changes. `key` is developer-controlled (a build-time hash or an
explicit `create('key')` argument), never visitor data, so interpolating
it into the registrar carries no XSS risk — and is unchanged from before.

Adds an e2e regression injecting a hostile store value
(`O'Brien`, `</script>`, `<!--`, backslashes, a newline) and asserting it
never appears raw in the HTML and survives SSR serialization + hydration
unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ziFzKm6QvjuU9yusBCEMU
---
 examples/zustand/.testRun.ts                      | 15 ++++++++++++---
 examples/zustand/pages/index/+data.ts             |  2 ++
 examples/zustand/todoItemHostile.ts               |  4 ++++
 .../vike-react-zustand/src/getOrCreateStore.ts    |  8 ++++++--
 4 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 examples/zustand/todoItemHostile.ts

diff --git a/examples/zustand/.testRun.ts b/examples/zustand/.testRun.ts
index 80ab49944..0439e5baf 100644
--- a/examples/zustand/.testRun.ts
+++ b/examples/zustand/.testRun.ts
@@ -12,6 +12,7 @@ import {
   expectLog,
   sleep,
 } from '@brillout/test-e2e'
+import { todoItemHostile } from './todoItemHostile'
 
 function testRun(cmd: 'pnpm run dev' | 'pnpm run preview') {
   const isDev = cmd === 'pnpm run dev'
@@ -53,23 +54,27 @@ function testRun(cmd: 'pnpm run dev' | 'pnpm run preview') {
       const html = await fetchHtml('/')
       expect(html).toContain(`<li>${buyApples}</li>`)
       expect(html).toContain(nodeVersion)
+      // The store state injected during SSR escapes hostile characters (https://github.com/vikejs/vike/issues/3463) — the raw text never occurs in the HTML: it's HTML-escaped inside <li> and, inside the injected <script type="application/json">, `<` is escaped so `</script>` can't appear
+      expect(html).not.toContain(todoItemHostile)
     }
     {
       const bodyText = await page.textContent('body')
       expect(bodyText).toContain(buyApples)
       expect(bodyText).toContain(nodeVersion)
-      expect(await getNumberOfItems()).toBe(2)
+      expect(await getNumberOfItems()).toBe(3)
+      // The hostile characters survive SSR store serialization + client-side hydration unchanged (https://github.com/vikejs/vike/issues/3463)
+      expect(await getTodoItemText(2)).toBe(todoItemHostile)
     }
   }
 
   test('todos - add to-do', async () => {
-    expect(await getNumberOfItems()).toBe(2)
+    expect(await getNumberOfItems()).toBe(3)
     if (isDev) await sleep(1000) // Seems to be required, otherwise the test is flaky. I don't know why.
     await page.fill('input[type="text"]', 'Buy bananas')
     await page.click('button[type="submit"]')
     const expectBananas = async () => {
       await autoRetry(async () => {
-        expect(await getNumberOfItems()).toBe(3)
+        expect(await getNumberOfItems()).toBe(4)
         expect(await page.textContent('body')).toContain('Buy bananas')
       })
     }
@@ -99,6 +104,10 @@ async function getNumberOfItems() {
   return await page.evaluate(() => document.querySelectorAll('#todo-list li').length)
 }
 
+async function getTodoItemText(index: number) {
+  return await page.evaluate((i) => document.querySelectorAll('#todo-list li')[i]?.textContent, index)
+}
+
 async function testCounter(currentValue?: number) {
   // autoRetry() in case page just got client-side navigated
   await autoRetry(
diff --git a/examples/zustand/pages/index/+data.ts b/examples/zustand/pages/index/+data.ts
index d95ec61e1..ff10d3c84 100644
--- a/examples/zustand/pages/index/+data.ts
+++ b/examples/zustand/pages/index/+data.ts
@@ -3,6 +3,7 @@ export { data }
 export type Data = Awaited<ReturnType<typeof data>>
 
 import type { PageContextServer } from 'vike/types'
+import { todoItemHostile } from '../../todoItemHostile'
 
 async function data(pageContext: PageContextServer) {
   const todoItemsInitial = await fetchTodosInit()
@@ -15,5 +16,6 @@ async function fetchTodosInit() {
     //
     { text: 'Buy apples' },
     { text: `Update Node.js ${process.version} to latest version` },
+    { text: todoItemHostile },
   ]
 }
diff --git a/examples/zustand/todoItemHostile.ts b/examples/zustand/todoItemHostile.ts
new file mode 100644
index 000000000..7854357b4
--- /dev/null
+++ b/examples/zustand/todoItemHostile.ts
@@ -0,0 +1,4 @@
+export { todoItemHostile }
+
+// A to-do text full of hostile characters — ensures that vike-react-zustand correctly transfers the store state it injects during SSR without breaking out of the injected <script> (https://github.com/vikejs/vike/issues/3463)
+const todoItemHostile = `Fix O'Brien's bug: escape \\ ' " </script> <!-- and \n🚀`
diff --git a/packages/vike-react-zustand/src/getOrCreateStore.ts b/packages/vike-react-zustand/src/getOrCreateStore.ts
index bef73bc1b..4e4fc4cfc 100644
--- a/packages/vike-react-zustand/src/getOrCreateStore.ts
+++ b/packages/vike-react-zustand/src/getOrCreateStore.ts
@@ -41,10 +41,14 @@ function getOrCreateStore<T>({
       const serverState = store.getInitialState()
       const transferableState = sanitizeForSerialization(serverState)
       assert(stream)
-      // No need to escape the injected HTML — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
+      // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
       const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
+      // The state is embedded as the textContent of an inert <script type="application/json"> (never parsed as JavaScript) instead of inside an executable JavaScript string literal, so no JavaScript-string escaping is needed: the only sensitive character is `<` (so that the HTML parser never encounters `</script>` nor `<!--` inside the block) and `htmlScriptSafe` escapes it. The adjacent registrar <script> runs synchronously at parse time and reads its own data block via `previousElementSibling` (both tags are injected together, so they're always adjacent). See https://github.com/vikejs/vike/issues/3463
+      // `key` is developer-controlled (a build-time hash or an explicit `create('key')` argument), never website-visitor data, so interpolating it into the registrar carries no XSS risk.
+      const serialized = stringify(transferableState, { htmlScriptSafe: true })
       stream.injectToStream(
-        `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']='${stringify(transferableState, { htmlScriptSafe: true })}'</script>`,
+        `<script type="application/json">${serialized}</script>` +
+          `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']=document.currentScript.previousElementSibling.textContent</script>`,
       )
       pageContext._vikeReactZustandStoresServer[key] = store
       return store

From a27c4bcb50f8a059fb9e61e3a232abd4efeebf0c Mon Sep 17 00:00:00 2001
From: brillout <claude@brillout.com>
Date: Fri, 14 Aug 2026 10:37:02 +0000
Subject: [PATCH 02/10] fix(vike-react): escape `<` in useConfig() streamed
 document.title (#3463)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`useConfig({ title })`, when applied after <head> has already been sent,
injects `document.title = ${JSON.stringify(title)}` into an inline
<script>. `JSON.stringify()` produces a valid double-quoted JavaScript
string literal (so `"` and `\` are handled), but it does not escape `<`,
so a title containing `</script>` breaks out of the inline <script> —
an XSS vector, since titles are often CMS/user-controlled.

Escape `<` (and U+2028/U+2029) the same way as the store-state injection.

This is the independent hardening that previously lived in the escaper PR;
carrying it here so this PR fully supersedes it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ziFzKm6QvjuU9yusBCEMU
---
 .../vike-react/src/hooks/useConfig/useConfig-server.ts | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
index f91dd58a6..b3c95fedf 100644
--- a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
+++ b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
@@ -61,9 +61,15 @@ type Stream = NonNullable<ReturnType<typeof useStreamOptional>>
 function apply(config: ConfigViaHook, stream: Stream, pageContext: PageContextServer) {
   const { title } = config
   if (title) {
-    // No need to escape the injected HTML — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
+    // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
     const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-    const htmlSnippet = `<script${nonceAttr}>document.title = ${JSON.stringify(title)}</script>`
+    // JSON.stringify() produces a valid double-quoted JavaScript string literal, but `<` must additionally be escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the inline <script> — the JavaScript parser decodes `\u003c` back to `<` (https://github.com/vikejs/vike/issues/3463)
+    // U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers
+    const titleJs = JSON.stringify(title)
+      .replace(/</g, '\\u003c')
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029')
+    const htmlSnippet = `<script${nonceAttr}>document.title = ${titleJs}</script>`
     stream.injectToStream(htmlSnippet)
   }
 }

From c94aa164838a16adf71e6f0211854f5d2a123e11 Mon Sep 17 00:00:00 2001
From: Romuald Brillout <git@brillout.com>
Date: Fri, 14 Aug 2026 12:36:21 +0200
Subject: [PATCH 03/10] revert example

---
 examples/zustand/.testRun.ts          | 15 +++------------
 examples/zustand/pages/index/+data.ts |  2 --
 examples/zustand/todoItemHostile.ts   |  4 ----
 3 files changed, 3 insertions(+), 18 deletions(-)
 delete mode 100644 examples/zustand/todoItemHostile.ts

diff --git a/examples/zustand/.testRun.ts b/examples/zustand/.testRun.ts
index 0439e5baf..80ab49944 100644
--- a/examples/zustand/.testRun.ts
+++ b/examples/zustand/.testRun.ts
@@ -12,7 +12,6 @@ import {
   expectLog,
   sleep,
 } from '@brillout/test-e2e'
-import { todoItemHostile } from './todoItemHostile'
 
 function testRun(cmd: 'pnpm run dev' | 'pnpm run preview') {
   const isDev = cmd === 'pnpm run dev'
@@ -54,27 +53,23 @@ function testRun(cmd: 'pnpm run dev' | 'pnpm run preview') {
       const html = await fetchHtml('/')
       expect(html).toContain(`<li>${buyApples}</li>`)
       expect(html).toContain(nodeVersion)
-      // The store state injected during SSR escapes hostile characters (https://github.com/vikejs/vike/issues/3463) — the raw text never occurs in the HTML: it's HTML-escaped inside <li> and, inside the injected <script type="application/json">, `<` is escaped so `</script>` can't appear
-      expect(html).not.toContain(todoItemHostile)
     }
     {
       const bodyText = await page.textContent('body')
       expect(bodyText).toContain(buyApples)
       expect(bodyText).toContain(nodeVersion)
-      expect(await getNumberOfItems()).toBe(3)
-      // The hostile characters survive SSR store serialization + client-side hydration unchanged (https://github.com/vikejs/vike/issues/3463)
-      expect(await getTodoItemText(2)).toBe(todoItemHostile)
+      expect(await getNumberOfItems()).toBe(2)
     }
   }
 
   test('todos - add to-do', async () => {
-    expect(await getNumberOfItems()).toBe(3)
+    expect(await getNumberOfItems()).toBe(2)
     if (isDev) await sleep(1000) // Seems to be required, otherwise the test is flaky. I don't know why.
     await page.fill('input[type="text"]', 'Buy bananas')
     await page.click('button[type="submit"]')
     const expectBananas = async () => {
       await autoRetry(async () => {
-        expect(await getNumberOfItems()).toBe(4)
+        expect(await getNumberOfItems()).toBe(3)
         expect(await page.textContent('body')).toContain('Buy bananas')
       })
     }
@@ -104,10 +99,6 @@ async function getNumberOfItems() {
   return await page.evaluate(() => document.querySelectorAll('#todo-list li').length)
 }
 
-async function getTodoItemText(index: number) {
-  return await page.evaluate((i) => document.querySelectorAll('#todo-list li')[i]?.textContent, index)
-}
-
 async function testCounter(currentValue?: number) {
   // autoRetry() in case page just got client-side navigated
   await autoRetry(
diff --git a/examples/zustand/pages/index/+data.ts b/examples/zustand/pages/index/+data.ts
index ff10d3c84..d95ec61e1 100644
--- a/examples/zustand/pages/index/+data.ts
+++ b/examples/zustand/pages/index/+data.ts
@@ -3,7 +3,6 @@ export { data }
 export type Data = Awaited<ReturnType<typeof data>>
 
 import type { PageContextServer } from 'vike/types'
-import { todoItemHostile } from '../../todoItemHostile'
 
 async function data(pageContext: PageContextServer) {
   const todoItemsInitial = await fetchTodosInit()
@@ -16,6 +15,5 @@ async function fetchTodosInit() {
     //
     { text: 'Buy apples' },
     { text: `Update Node.js ${process.version} to latest version` },
-    { text: todoItemHostile },
   ]
 }
diff --git a/examples/zustand/todoItemHostile.ts b/examples/zustand/todoItemHostile.ts
deleted file mode 100644
index 7854357b4..000000000
--- a/examples/zustand/todoItemHostile.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-export { todoItemHostile }
-
-// A to-do text full of hostile characters — ensures that vike-react-zustand correctly transfers the store state it injects during SSR without breaking out of the injected <script> (https://github.com/vikejs/vike/issues/3463)
-const todoItemHostile = `Fix O'Brien's bug: escape \\ ' " </script> <!-- and \n🚀`

From 3b99cdebe4e12a924503a39155a3e7c75256dedc Mon Sep 17 00:00:00 2001
From: Romuald Brillout <git@brillout.com>
Date: Fri, 14 Aug 2026 12:36:45 +0200
Subject: [PATCH 04/10] remove comment

---
 packages/vike-react-zustand/src/getOrCreateStore.ts | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/vike-react-zustand/src/getOrCreateStore.ts b/packages/vike-react-zustand/src/getOrCreateStore.ts
index 4e4fc4cfc..3e5b75fde 100644
--- a/packages/vike-react-zustand/src/getOrCreateStore.ts
+++ b/packages/vike-react-zustand/src/getOrCreateStore.ts
@@ -43,8 +43,6 @@ function getOrCreateStore<T>({
       assert(stream)
       // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
       const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-      // The state is embedded as the textContent of an inert <script type="application/json"> (never parsed as JavaScript) instead of inside an executable JavaScript string literal, so no JavaScript-string escaping is needed: the only sensitive character is `<` (so that the HTML parser never encounters `</script>` nor `<!--` inside the block) and `htmlScriptSafe` escapes it. The adjacent registrar <script> runs synchronously at parse time and reads its own data block via `previousElementSibling` (both tags are injected together, so they're always adjacent). See https://github.com/vikejs/vike/issues/3463
-      // `key` is developer-controlled (a build-time hash or an explicit `create('key')` argument), never website-visitor data, so interpolating it into the registrar carries no XSS risk.
       const serialized = stringify(transferableState, { htmlScriptSafe: true })
       stream.injectToStream(
         `<script type="application/json">${serialized}</script>` +

From d3181e343f936794dcd3660b166f4a96262ae2cf Mon Sep 17 00:00:00 2001
From: Romuald Brillout <git@brillout.com>
Date: Fri, 14 Aug 2026 12:38:05 +0200
Subject: [PATCH 05/10] minor refactor

---
 packages/vike-react-zustand/src/getOrCreateStore.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/packages/vike-react-zustand/src/getOrCreateStore.ts b/packages/vike-react-zustand/src/getOrCreateStore.ts
index 3e5b75fde..d9ef87ceb 100644
--- a/packages/vike-react-zustand/src/getOrCreateStore.ts
+++ b/packages/vike-react-zustand/src/getOrCreateStore.ts
@@ -43,9 +43,8 @@ function getOrCreateStore<T>({
       assert(stream)
       // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
       const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-      const serialized = stringify(transferableState, { htmlScriptSafe: true })
       stream.injectToStream(
-        `<script type="application/json">${serialized}</script>` +
+        `<script type="application/json">${stringify(transferableState, { htmlScriptSafe: true })}</script>` +
           `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']=document.currentScript.previousElementSibling.textContent</script>`,
       )
       pageContext._vikeReactZustandStoresServer[key] = store

From 0743e20659c668181c3627a17faddef7afa4a9a7 Mon Sep 17 00:00:00 2001
From: brillout <claude@brillout.com>
Date: Fri, 14 Aug 2026 10:43:12 +0000
Subject: [PATCH 06/10] refactor(vike-react): extract escapeForHtmlScript()
 util
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the inline-<script> escaping (`<` → `<`, U+2028/U+2029) out of
useConfig()'s document.title injection into a reusable
`escapeForHtmlScript()` utility.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ziFzKm6QvjuU9yusBCEMU
---
 .../src/hooks/useConfig/useConfig-server.ts          |  9 +++------
 packages/vike-react/src/utils/escapeForHtmlScript.ts | 12 ++++++++++++
 2 files changed, 15 insertions(+), 6 deletions(-)
 create mode 100644 packages/vike-react/src/utils/escapeForHtmlScript.ts

diff --git a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
index b3c95fedf..db8a60fb6 100644
--- a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
+++ b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
@@ -8,6 +8,7 @@ import { useStreamOptional } from 'react-streaming'
 import { objectKeys } from '../../utils/objectKeys.js'
 import { includes } from '../../utils/includes.js'
 import { assert } from '../../utils/assert.js'
+import { escapeForHtmlScript } from '../../utils/escapeForHtmlScript.js'
 import { configsCumulative } from './configsCumulative.js'
 import { configsClientSide } from './configsClientSide.js'
 
@@ -63,12 +64,8 @@ function apply(config: ConfigViaHook, stream: Stream, pageContext: PageContextSe
   if (title) {
     // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
     const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-    // JSON.stringify() produces a valid double-quoted JavaScript string literal, but `<` must additionally be escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the inline <script> — the JavaScript parser decodes `\u003c` back to `<` (https://github.com/vikejs/vike/issues/3463)
-    // U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers
-    const titleJs = JSON.stringify(title)
-      .replace(/</g, '\\u003c')
-      .replace(/\u2028/g, '\\u2028')
-      .replace(/\u2029/g, '\\u2029')
+    // `document.title = <title>` runs as JavaScript => escape the JSON string literal so it can't break out of the inline <script> (https://github.com/vikejs/vike/issues/3463)
+    const titleJs = escapeForHtmlScript(JSON.stringify(title))
     const htmlSnippet = `<script${nonceAttr}>document.title = ${titleJs}</script>`
     stream.injectToStream(htmlSnippet)
   }
diff --git a/packages/vike-react/src/utils/escapeForHtmlScript.ts b/packages/vike-react/src/utils/escapeForHtmlScript.ts
new file mode 100644
index 000000000..4b0f1974e
--- /dev/null
+++ b/packages/vike-react/src/utils/escapeForHtmlScript.ts
@@ -0,0 +1,12 @@
+// https://github.com/vikejs/vike/issues/3463
+/**
+ * Escapes a JavaScript expression (e.g. the output of `JSON.stringify()`) so that it can be safely embedded inside an inline `<script>`.
+ * - `<` is escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the `<script>` — the JavaScript parser decodes `\u003c` back to `<`. (The input must be a JavaScript expression whose `<` only ever occurs inside string literals, such as `JSON.stringify()` output.)
+ * - U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers.
+ */
+export function escapeForHtmlScript(js: string): string {
+  return js
+    .replace(/</g, '\\u003c')
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}

From 6ff15b32752d93b4a18c693eaa303ce065785753 Mon Sep 17 00:00:00 2001
From: brillout <claude@brillout.com>
Date: Fri, 14 Aug 2026 10:58:22 +0000
Subject: [PATCH 07/10] refactor(vike-react): rename util to
 escapeJavaScriptExpression()

---
 packages/vike-react/src/hooks/useConfig/useConfig-server.ts   | 4 ++--
 .../{escapeForHtmlScript.ts => escapeJavaScriptExpression.ts} | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
 rename packages/vike-react/src/utils/{escapeForHtmlScript.ts => escapeJavaScriptExpression.ts} (91%)

diff --git a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
index db8a60fb6..458d71e2f 100644
--- a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
+++ b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
@@ -8,7 +8,7 @@ import { useStreamOptional } from 'react-streaming'
 import { objectKeys } from '../../utils/objectKeys.js'
 import { includes } from '../../utils/includes.js'
 import { assert } from '../../utils/assert.js'
-import { escapeForHtmlScript } from '../../utils/escapeForHtmlScript.js'
+import { escapeJavaScriptExpression } from '../../utils/escapeJavaScriptExpression.js'
 import { configsCumulative } from './configsCumulative.js'
 import { configsClientSide } from './configsClientSide.js'
 
@@ -65,7 +65,7 @@ function apply(config: ConfigViaHook, stream: Stream, pageContext: PageContextSe
     // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
     const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
     // `document.title = <title>` runs as JavaScript => escape the JSON string literal so it can't break out of the inline <script> (https://github.com/vikejs/vike/issues/3463)
-    const titleJs = escapeForHtmlScript(JSON.stringify(title))
+    const titleJs = escapeJavaScriptExpression(JSON.stringify(title))
     const htmlSnippet = `<script${nonceAttr}>document.title = ${titleJs}</script>`
     stream.injectToStream(htmlSnippet)
   }
diff --git a/packages/vike-react/src/utils/escapeForHtmlScript.ts b/packages/vike-react/src/utils/escapeJavaScriptExpression.ts
similarity index 91%
rename from packages/vike-react/src/utils/escapeForHtmlScript.ts
rename to packages/vike-react/src/utils/escapeJavaScriptExpression.ts
index 4b0f1974e..c52b3cd34 100644
--- a/packages/vike-react/src/utils/escapeForHtmlScript.ts
+++ b/packages/vike-react/src/utils/escapeJavaScriptExpression.ts
@@ -4,7 +4,7 @@
  * - `<` is escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the `<script>` — the JavaScript parser decodes `\u003c` back to `<`. (The input must be a JavaScript expression whose `<` only ever occurs inside string literals, such as `JSON.stringify()` output.)
  * - U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers.
  */
-export function escapeForHtmlScript(js: string): string {
+export function escapeJavaScriptExpression(js: string): string {
   return js
     .replace(/</g, '\\u003c')
     .replace(/\u2028/g, '\\u2028')

From ef2140c1b42e9e714664a6aa9a04a08e2b272cd9 Mon Sep 17 00:00:00 2001
From: brillout <claude@brillout.com>
Date: Fri, 14 Aug 2026 10:58:22 +0000
Subject: [PATCH 08/10] add CSP nonce to the injected <script
 type="application/json"> data block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Not strictly required — a data block is never executed, so CSP script-src
doesn't gate it — but vike core adds the nonce to its own
type="application/json" pageContext/globalContext blocks, so match that
for consistency.
---
 packages/vike-react-zustand/src/getOrCreateStore.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/vike-react-zustand/src/getOrCreateStore.ts b/packages/vike-react-zustand/src/getOrCreateStore.ts
index d9ef87ceb..50369d8a3 100644
--- a/packages/vike-react-zustand/src/getOrCreateStore.ts
+++ b/packages/vike-react-zustand/src/getOrCreateStore.ts
@@ -44,7 +44,7 @@ function getOrCreateStore<T>({
       // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
       const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
       stream.injectToStream(
-        `<script type="application/json">${stringify(transferableState, { htmlScriptSafe: true })}</script>` +
+        `<script type="application/json"${nonceAttr}>${stringify(transferableState, { htmlScriptSafe: true })}</script>` +
           `<script${nonceAttr}>if(!globalThis._vikeReactZustandState)globalThis._vikeReactZustandState={};globalThis._vikeReactZustandState['${key}']=document.currentScript.previousElementSibling.textContent</script>`,
       )
       pageContext._vikeReactZustandStoresServer[key] = store

From ffc862dd2297484ea694882a711bf77a8a8868fa Mon Sep 17 00:00:00 2001
From: Romuald Brillout <git@brillout.com>
Date: Fri, 14 Aug 2026 13:19:59 +0200
Subject: [PATCH 09/10] comment

---
 .../src/utils/escapeJavaScriptExpression.ts     | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/packages/vike-react/src/utils/escapeJavaScriptExpression.ts b/packages/vike-react/src/utils/escapeJavaScriptExpression.ts
index c52b3cd34..5bb06ccd7 100644
--- a/packages/vike-react/src/utils/escapeJavaScriptExpression.ts
+++ b/packages/vike-react/src/utils/escapeJavaScriptExpression.ts
@@ -1,12 +1,15 @@
-// https://github.com/vikejs/vike/issues/3463
 /**
  * Escapes a JavaScript expression (e.g. the output of `JSON.stringify()`) so that it can be safely embedded inside an inline `<script>`.
- * - `<` is escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the `<script>` — the JavaScript parser decodes `\u003c` back to `<`. (The input must be a JavaScript expression whose `<` only ever occurs inside string literals, such as `JSON.stringify()` output.)
- * - U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers.
+ *
+ * https://github.com/vikejs/vike/issues/3463
  */
 export function escapeJavaScriptExpression(js: string): string {
-  return js
-    .replace(/</g, '\\u003c')
-    .replace(/\u2028/g, '\\u2028')
-    .replace(/\u2029/g, '\\u2029')
+  return (
+    js
+      // `<` is escaped so that the HTML parser never encounters `</script>` nor `<!--` inside the `<script>` — the JavaScript parser decodes `\u003c` back to `<`. (The input must be a JavaScript expression whose `<` only ever occurs inside string literals, such as `JSON.stringify()` output.)
+      .replace(/</g, '\\u003c')
+      // U+2028/U+2029 are escaped because a raw U+2028/U+2029 inside a JavaScript string literal is a syntax error in pre-ES2019 browsers.
+      .replace(/\u2028/g, '\\u2028')
+      .replace(/\u2029/g, '\\u2029')
+  )
 }

From 960ce837428a75b5b0f30d78a676effa068c10d7 Mon Sep 17 00:00:00 2001
From: Romuald Brillout <git@brillout.com>
Date: Fri, 14 Aug 2026 13:30:55 +0200
Subject: [PATCH 10/10] comment

---
 packages/vike-react/src/hooks/useConfig/useConfig-server.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
index 458d71e2f..cab4df9b5 100644
--- a/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
+++ b/packages/vike-react/src/hooks/useConfig/useConfig-server.ts
@@ -64,7 +64,6 @@ function apply(config: ConfigViaHook, stream: Stream, pageContext: PageContextSe
   if (title) {
     // No need to escape the injected nonce attribute — see https://github.com/vikejs/vike/blob/36201ddad5f5b527b244b24d548014ec86c204e4/packages/vike/src/server/runtime/renderPageServer/csp.ts#L45
     const nonceAttr = pageContext.cspNonce ? ` nonce="${pageContext.cspNonce}"` : ''
-    // `document.title = <title>` runs as JavaScript => escape the JSON string literal so it can't break out of the inline <script> (https://github.com/vikejs/vike/issues/3463)
     const titleJs = escapeJavaScriptExpression(JSON.stringify(title))
     const htmlSnippet = `<script${nonceAttr}>document.title = ${titleJs}</script>`
     stream.injectToStream(htmlSnippet)