CVE-2026-71318 Overview
CVE-2026-71318 affects Nuxt, an open-source web development framework for Vue.js. Attackers can supply a top-level as prop to the /__nuxt_island/ endpoint and influence dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). The flaw impacts Nuxt versions from 3.1.0 up to but not including 3.21.10, and the 4.x line up to but not including 4.5.1. The maintainers addressed the issue in Nuxt 3.21.10 and 4.5.1. The vulnerability is classified as improper input validation [CWE-20].
Critical Impact
Unauthenticated network attackers can manipulate dynamic component resolution on the server, leading to limited confidentiality and integrity impact on affected Nuxt applications.
Affected Products
- Nuxt 3.1.0 through 3.21.9
- Nuxt 4.0.0 through 4.5.0
- Applications exposing the /__nuxt_island/ server component endpoint
Discovery Timeline
- 2026-08-05 - CVE-2026-71318 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71318
Vulnerability Analysis
Nuxt exposes the /__nuxt_island/ endpoint to render server components asynchronously. The endpoint accepts request-controlled props that are forwarded into Vue's rendering pipeline. When an attacker supplies a top-level as prop, that value flows into dynamic component resolution paths such as <component :is>, resolveDynamicComponent, and the h() render function.
Because the framework does not restrict which component identifiers can be resolved from this input, an attacker can steer server-side rendering to components that were not intended to be reachable through the island endpoint. The impact is limited to confidentiality and integrity of rendered output, with no direct availability effect.
Root Cause
The root cause is improper input validation [CWE-20] of the as prop received by /__nuxt_island/. The endpoint trusts the caller-supplied component identifier and passes it through Vue's dynamic component resolution without an allowlist or sanitization layer.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker crafts a request to /__nuxt_island/ that includes a top-level as prop referencing a component name of their choosing. The request complexity is elevated because the attacker must know or infer a resolvable component name and understand the server component context. Refer to the GitHub Security Advisory GHSA-48hr-524c-v5w3 for technical details.
Detection Methods for CVE-2026-71318
Indicators of Compromise
- Unexpected HTTP requests to the /__nuxt_island/ endpoint containing an as parameter or prop in the payload
- Server-rendered responses referencing components that are not linked from application routes
- Anomalous spikes in island endpoint traffic from single source IPs or automated clients
Detection Strategies
- Inspect web server and reverse proxy logs for /__nuxt_island/ requests and correlate with query strings or JSON bodies containing as
- Alert on requests where the as value references internal or administrative component names
- Compare deployed Nuxt version against the fixed releases 3.21.10 and 4.5.1 during software composition analysis
Monitoring Recommendations
- Ingest Nuxt application and edge logs into a centralized analytics pipeline for query-based hunting
- Track version metadata for Nuxt in dependency manifests (package.json, lockfiles) across all deployed services
- Baseline normal /__nuxt_island/ request patterns and flag deviations in prop keys or component identifiers
How to Mitigate CVE-2026-71318
Immediate Actions Required
- Upgrade Nuxt to 3.21.10 for the 3.x branch or 4.5.1 for the 4.x branch
- Audit application dependencies and transitive dependencies pinning Nuxt to a vulnerable range
- Review server components for sensitive rendering logic that should not be reachable via island endpoints
Patch Information
The Nuxt maintainers released fixes in Nuxt v3.21.10 and Nuxt v4.5.1. Both releases restrict how the as prop is processed during dynamic component resolution at the /__nuxt_island/ endpoint.
Workarounds
- Restrict access to /__nuxt_island/ at the reverse proxy or web application firewall until patched
- Filter or drop client-supplied as props on requests targeting the island endpoint
- Limit the set of components registered globally so unintended targets cannot be resolved dynamically
# Upgrade to a patched Nuxt release
npm install nuxt@3.21.10
# or, for the 4.x branch
npm install nuxt@4.5.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
