CVE-2026-71321 Details
Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
A denial-of-service vulnerability has been identified in Nuxt versions 3.1.0 prior to 3.21.10 and 4.0.0 prior to 4.5.1. The issue arises in the internal island renderer endpoint '/__nuxt_island/...' which processes and hashes JSON body input controlled by the attacker. This occurs before validating the hash residing in the URL. An unauthenticated 'POST' request to '/__nuxt_island/_.json' with a large JSON body is fully read, parsed, and hashed, only to be rejected, wasting CPU resources on the Nitro single event loop and delaying concurrent requests. No valid hash or authentication is required to exploit this vulnerability.
This vulnerability has been patched in Nuxt versions 4.5.1 and 3.21.10. Users should upgrade to these versions. Instructions for upgrading are available on the Nuxt website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e | [email protected] | Source CodeVendor |
| https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22 | [email protected] | Source CodeVendor |
| https://github.com/nuxt/nuxt/releases/tag/v3.21.10 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/releases/tag/v4.5.1 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuxt | >= 4.0.0, < 4.5.1 (semver) >= 3.1.0, < 3.21.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |