CVE-2026-71318

Received Received - Intake

Remote Code Execution in Nuxt.js Framework

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71318

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	From 3.1.0 (inc) to 3.21.10 (inc)
nuxt	nuxt	4.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuxt framework versions 3.1.0 to 3.21.10 and 4.5.1 allows an attacker to supply a top-level 'as' prop to the /__nuxt_island/ endpoint. This can drive dynamic component resolution through Vue.js component rendering methods like <component :is>, resolveDynamicComponent, or h().

Detection Guidance

To detect this vulnerability, check the installed version of Nuxt. If it is between 3.1.0 and 3.21.9 or 4.0.0 and 4.5.0, it is vulnerable. Run: npm list nuxt or yarn list nuxt to verify the version.

Impact Analysis

An attacker could exploit this to render arbitrary components on the server side, potentially leading to server-side request forgery, unauthorized data access, or other malicious activities depending on the application's context.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, which may violate GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance impact depends on the specific data processed by the affected application.

Mitigation Strategies

Update Nuxt to version 3.21.10 or 4.5.1 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-71318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70