CVE-2026-71314: Nuxt Framework DOS Vulnerability

CVE-2026-71314 Overview

CVE-2026-71314 is a resource exhaustion vulnerability [CWE-400] in Nuxt, an open-source web development framework for Vue.js. Versions from 3.1.0 up to (but not including) 3.21.10 and 4.5.1 are affected. An unauthenticated remote attacker can abuse a server island v-for prop, including vforToArray, to trigger unbounded server-side rendering (SSR) memory allocation. The allocation grows up to MAX_VFOR_LENGTH = 100000 iterations per request and crashes the Nuxt process. The issue is fixed in Nuxt 3.21.10 and 4.5.1.

Critical Impact
Unauthenticated attackers can crash Nuxt SSR processes over the network with a single crafted island request, causing service outage.

Affected Products

Nuxt 3.1.0 through 3.21.9
Nuxt 4.0.0 through 4.5.0
Applications using server islands with v-for props

Discovery Timeline

2026-08-05 - CVE-2026-71314 published to NVD
2026-08-05 - Last updated in NVD database
Fixed releases: Nuxt v3.21.10 and v4.5.1 published on GitHub

Technical Details for CVE-2026-71314

Vulnerability Analysis

The vulnerability resides in Nuxt's server islands rendering path. Server islands accept props from the client, including arrays consumed by v-for directives during SSR. Before the patch, the island endpoint parsed and processed request bodies without enforcing bounds on body size, JSON nesting depth, or array length.

An unauthenticated attacker sends a crafted island request containing a large or nested v-for payload. The server allocates memory proportional to the payload while iterating up to MAX_VFOR_LENGTH = 100000 entries. Repeated or sufficiently large requests exhaust the Node.js heap and terminate the Nuxt worker.

Root Cause

The root cause is missing input validation on the island request body and downstream v-for array construction. Untrusted input drove unbounded work in the SSR pipeline, matching [CWE-400] Uncontrolled Resource Consumption. The vforToArray helper and related utilities in packages/nuxt/src/app/components/utils.ts did not enforce upper bounds prior to iteration.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker issues HTTP requests to any server island endpoint exposed by the Nuxt application, supplying oversized or deeply nested JSON props. The fix introduces guards on the raw request body before parsing and hashing, so oversized or deeply nested payloads are rejected on unauthenticated input.

typescript

// Security patch: packages/nitro-server/src/runtime/utils/island-props.ts
// Guards applied to the raw island request body before it is parsed and hashed, so an
// oversized or deeply nested payload is rejected before that work runs on unauthenticated
// input.

/** @internal */
export const MAX_ISLAND_BODY_BYTES = 64 * 1024

/** @internal */
export const MAX_ISLAND_PROP_DEPTH = 64

/**
 * Whether the bracket nesting of a JSON-ish string exceeds `maxDepth`, in a single linear
 * pass. Brackets inside string values are ignored.
 *
 * @internal
 */
export function exceedsMaxDepth (raw: string, maxDepth = MAX_ISLAND_PROP_DEPTH): boolean {
  let depth = 0
  let inString = false
  let escaped = false
  for (let i = 0; i < raw.length; i++) {
    const ch = raw[i]
    if (inString) {
      if (escaped) {
        escaped = false
      } else if (ch === '\\') {
        escaped = true
      } else if (ch === '"') {
        inString = false
      }
// Source: https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e

Detection Methods for CVE-2026-71314

Indicators of Compromise

Repeated HTTP requests to island endpoints (paths under /__nuxt_island/) carrying request bodies larger than 64 KB.
Requests containing JSON props with deep bracket nesting exceeding 64 levels or v-for arrays approaching 100,000 elements.
Nuxt worker process crashes, out-of-memory (OOM) exits, or V8 heap out of memory errors correlated with island traffic.
Sudden spikes in SSR latency, event loop lag, or resident set size (RSS) on Nuxt Node.js processes.

Detection Strategies

Inspect reverse proxy or WAF logs for POST requests to island routes with abnormally large Content-Length values.
Correlate Node.js process restarts with inbound request patterns targeting server island endpoints.
Alert when a single client IP or user agent sends multiple oversized island payloads within a short window.

Monitoring Recommendations

Monitor Node.js heap usage, event loop delay, and process restart counts on Nuxt SSR hosts.
Enable request body size limits at the reverse proxy (nginx, Caddy, load balancer) and log rejections.
Track application logs for parser errors or aborted requests originating from island handlers.

How to Mitigate CVE-2026-71314

Immediate Actions Required

Upgrade Nuxt to 3.21.10 (for the 3.x branch) or 4.5.1 (for the 4.x branch) without delay.
Enforce a request body size limit at the reverse proxy for island endpoints, for example 64 KB, matching the upstream MAX_ISLAND_BODY_BYTES guard.
Rate-limit unauthenticated requests to server island routes to reduce blast radius.

Patch Information

The fix is delivered in Nuxt v3.21.10 and v4.5.1. The patch introduces MAX_ISLAND_BODY_BYTES, MAX_ISLAND_PROP_DEPTH, and enforces MAX_VFOR_LENGTH in packages/nuxt/src/app/components/utils.ts. Full technical details are available in the GitHub Security Advisory GHSA-hxcr-hm88-mpq6 and the commits 4e35ae9 and 668cdfd.

Workarounds

If immediate patching is not possible, disable server islands or restrict access to island routes at the edge.
Configure the reverse proxy to reject requests to /__nuxt_island/* larger than 64 KB.
Deploy a WAF rule inspecting JSON depth and array length on island endpoints and block requests exceeding safe thresholds.

bash

# Nginx: limit request body size and rate for Nuxt island endpoints
limit_req_zone $binary_remote_addr zone=nuxt_island:10m rate=10r/s;

server {
  location ~ ^/__nuxt_island/ {
    client_max_body_size 64k;
    limit_req zone=nuxt_island burst=20 nodelay;
    proxy_pass http://nuxt_upstream;
  }
}