CVE-2026-71320: Nuxt.js Framework RCE Vulnerability

CVE-2026-71320 Overview

CVE-2026-71320 is a template injection vulnerability in Nuxt, an open-source web development framework for Vue.js. The flaw affects versions from 3.4.0 up to 3.21.10 and 4.5.1. An attacker can inject a template key through /__nuxt_island/ props into a dynamic component when vue.runtimeCompiler: true is enabled. The injected template is then compiled and executed inside the Nitro server process. This falls under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). The issue is fixed in Nuxt 3.21.10 and 4.5.1.

Critical Impact
Remote attackers can execute arbitrary Vue templates in the server-side Nitro runtime, leading to server-side code execution when runtime template compilation is enabled.

Affected Products

Nuxt versions >= 3.4.0 and < 3.21.10
Nuxt versions >= 4.0.0 and < 4.5.1
Applications with vue.runtimeCompiler: true in Nuxt configuration

Discovery Timeline

2026-08-05 - CVE CVE-2026-71320 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71320

Vulnerability Analysis

Nuxt exposes an internal /__nuxt_island/ endpoint used to render server-side island components. This endpoint accepts JSON props for dynamic components. When an application enables the Vue runtime compiler via vue.runtimeCompiler: true, a template property reaching Vue component resolution is compiled and executed as a Vue template. The Nuxt island handler did not reject reserved prop keys, allowing an attacker-controlled template value to flow directly into the component resolution path inside the Nitro server process.

Root Cause

The root cause is missing input validation on island props submitted to the island rendering handler in packages/nitro-server/src/runtime/handlers/island.ts. Vue's runtime compiler treats a template string on a component descriptor as source to compile. Because the framework did not enforce a deny list on inbound props, the template key was reachable through nested objects in the JSON payload. The render key was not exploitable because JSON cannot carry a function value.

Attack Vector

The attack is remote and unauthenticated. An attacker sends a crafted request to the /__nuxt_island/ endpoint including a template property in the props tree. When the server resolves the dynamic component with runtime compilation enabled, the supplied template string is compiled and executed server-side inside Nitro. High attack complexity reflects the requirement that the target build ships vue.runtimeCompiler: true.

typescript

// Security patch: findUnsafeIslandPropKey walks the props tree
// and rejects any object containing a reserved `template` key.
// Source: https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418

export type UnsafeIslandPropKey = 'template'

/**
 * Find a `template` key anywhere in island props. With the Vue runtime compiler bundled, a
 * `template` string reaching component resolution would be compiled and executed. (`render`
 * is not checked: props arrive as JSON, so it can only be an inert string, never a function.)
 *
 * @internal
 */
export function findUnsafeIslandPropKey (value: unknown): UnsafeIslandPropKey | undefined {
  const pending = [value]
  const seen = new Set<object>()

  while (pending.length) {
    const current = pending.pop()
    if (!current || typeof current !== 'object' || seen.has(current)) {
      continue
    }
    seen.add(current)

    for (const key of Object.keys(current)) {
      if (key === 'template') {
        return key
      }
      pending.push((current as Record<string, unknown>)[key])
    }
  }
}

Source: GitHub Commit 5b60017

Detection Methods for CVE-2026-71320

Indicators of Compromise

HTTP requests to /__nuxt_island/ paths containing a template key in the JSON props payload.
Nitro server diagnostic code NUXT_E8005 in application logs, indicating a rejected template prop after patching.
Unexpected child processes or outbound connections originating from the Node.js Nitro process serving Nuxt.

Detection Strategies

Inspect reverse proxy and application logs for POST or GET requests to /__nuxt_island/* that include "template" substrings in request bodies or query strings.
Audit the Nuxt configuration (nuxt.config.ts) to identify applications with vue.runtimeCompiler: true, which are the only vulnerable deployments.
Deploy a web application firewall rule that blocks island prop payloads containing a template field until upgrades complete.

Monitoring Recommendations

Alert on anomalous process spawns, file writes, or outbound network traffic from Node.js processes running Nuxt/Nitro.
Track the installed Nuxt package version across build artifacts and container images to confirm upgrade coverage.
Correlate island endpoint request spikes with 5xx responses or new error codes such as NUXT_E8005 after patching.

How to Mitigate CVE-2026-71320

Immediate Actions Required

Upgrade Nuxt to 3.21.10 or 4.5.1 immediately across all environments.
If upgrade is not possible, set vue.runtimeCompiler: false in nuxt.config.ts to eliminate the runtime template compilation path.
Restrict external access to the /__nuxt_island/ endpoint at the reverse proxy where feasible.

Patch Information

The fix is delivered in Nuxt v3.21.10 and v4.5.1. The primary fix introduces findUnsafeIslandPropKey in packages/nuxt/src/app/island-props.ts and wires it into the island handler in packages/nitro-server/src/runtime/handlers/island.ts. A new diagnostic NUXT_E8005 is emitted when a request supplies a reserved template prop. Full technical background is documented in GitHub Security Advisory GHSA-9473-5f9j-94wq.

Workarounds

Disable vue.runtimeCompiler in the Nuxt configuration to prevent Vue from compiling attacker-supplied template strings at runtime.
Rename any legitimate props called template to a non-reserved name such as templateName before upgrading.
Add WAF or middleware validation that rejects island prop payloads containing a template key at any depth.

bash

# Upgrade Nuxt to a patched release
npm install nuxt@3.21.10
# or, for the v4 line
npm install nuxt@4.5.1

# Verify installed version
npx nuxt info | grep -i nuxt