CVE-2026-71314

Received Received - Intake

Memory Exhaustion in Nuxt.js via Unbounded SSR Allocation

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71314

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	From 3.1.0 (inc) to 3.21.10 (inc)
nuxt	nuxt	4.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuxt framework versions 3.1.0 to 3.21.10 and 4.5.1 allows an unauthenticated attacker to exploit a server island v-for prop to cause unbounded server-side rendering memory allocation. The attack sets MAX_VFOR_LENGTH to 100000, crashing the Nuxt process.

Detection Guidance

This vulnerability can be detected by checking the Nuxt.js version in use. If your system is running Nuxt.js versions between 3.1.0 and 3.21.10 or 4.5.1, it is vulnerable. Run 'npm list nuxt' or 'yarn list nuxt' to check the installed version.

Impact Analysis

This vulnerability can cause denial of service by crashing the Nuxt server process, leading to service unavailability. It does not allow data access or modification but disrupts normal operations.

Mitigation Strategies

Upgrade Nuxt.js to version 3.21.10 or 4.5.1 or later immediately. If upgrading is not possible, restrict server access to trusted sources and monitor for unusual memory usage patterns.

Hi! I’m here to help you understand CVE-2026-71314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70