Log in Start free

Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M

CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

High 7.5

In plain English

A high-severity resource allocation without limits in nuxt from nuxt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 45.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmnuxt4.5.1GHSA-9pgf-384g-p7mv
npmnuxt3.21.10GHSA-9pgf-384g-p7mv

Affected products (as reported)

VendorProductVersions
nuxt nuxt >= 4.0.0, < 4.5.1>= 3.1.0, < 3.21.10

Weakness: CWE-407, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References