Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-71318 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.9 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:4.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/nuxt/nuxt/releases/tag/v3.21.10	[email protected]	Release NotesVendor
https://github.com/nuxt/nuxt/releases/tag/v4.5.1	[email protected]	Release NotesVendor
https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-20	Improper Input Validation	[email protected]

Affected Products

Product	Versions
Nuxt	>= 3.1.0, < 3.21.10 (semver) >= 4.0.0, < 4.5.1 (semver)
CPE cpe:2.3:a:nuxt:nuxt:::::::: Remediation Upgrade: 3.21.10moderate effort Upgrade: 4.5.1moderate effort Workaround:low effort Do not forward island props into `<component :is>`, `resolveDynamicComponent`, or `h()`. Map an untrusted discriminator through a closed allowlist of imported component definitions instead of passing the raw prop value. Workaround:low effort Declare the props an island accepts, or set `inheritAttrs: false` on it, so request input cannot fall through to a polymorphic root component. Workaround:low effort Avoid registering sensitive components globally that could leak information if instantiated by an attacker.

Product

Versions

Nuxt

>= 3.1.0, < 3.21.10 (semver)

>= 4.0.0, < 4.5.1 (semver)

CPE

cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*

Remediation

Upgrade: 3.21.10moderate effort
Upgrade: 4.5.1moderate effort
Workaround:low effort
Do not forward island props into `<component :is>`, `resolveDynamicComponent`, or `h()`. Map an untrusted discriminator through a closed allowlist of imported component definitions instead of passing the raw prop value.
Workaround:low effort
Declare the props an island accepts, or set `inheritAttrs: false` on it, so request input cannot fall through to a polymorphic root component.
Workaround:low effort
Avoid registering sensitive components globally that could leak information if instantiated by an attacker.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 6, 2026	CVE Modified	CISA-ADP
Aug 5, 2026	New CVE Received	[email protected]