CVE-2026-71314 Details

A denial-of-service vulnerability has been identified in Nuxt, an open-source web development framework for Vue.js. This issue affects Nuxt versions 3.1.0 prior to 3.21.10 and version 4.0.0 prior to 4.5.1. The vulnerability allows an unauthenticated attacker to exploit server components by manipulating a 'v-for' prop, leading to excessive server-side memory usage and process crashes. The attack leverages the island component system, where props can be controlled by the attacker. By sending a large integer value through the 'v-for' prop, the server allocates memory proportional to the specified count, causing out-of-memory crashes. This vulnerability impacts both standard 'v-for' iterations and those applied to slot props, such as 'v-for' in a '<slot>' element.

Users can upgrade to Nuxt versions 3.21.10 or 4.5.1, where this vulnerability has been fixed. After upgrading, it's recommended to refresh the project's lockfile to ensure all dependencies are up to date.