CVE-2026-71321

Received Received - Intake

Denial of Service in Nuxt Framework via Malicious JSON Input

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71321

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	From 3.1.0 (inc) to 3.21.10 (inc)
nuxt	nuxt	4.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Nuxt framework versions between 3.1.0 and 3.21.10, and 4.5.1. It involves an internal island renderer endpoint that processes attacker-controlled JSON input without proper validation. The endpoint decodes and hashes the input before checking the URL-resident hash, leading to unnecessary CPU usage and delayed responses for legitimate requests.

Detection Guidance

Detecting this vulnerability requires checking the Nuxt.js version in use. If your system runs Nuxt.js versions between 3.1.0 and 3.21.10 or 4.5.1, it is vulnerable. Check the version by inspecting package.json or running npm list nuxt in your project directory.

Impact Analysis

An attacker could send large JSON payloads to the vulnerable endpoint, causing the server to waste CPU resources parsing and hashing the data. This may result in slower performance for all users, potential denial-of-service conditions, and increased server load.

Compliance Impact

This vulnerability primarily causes denial-of-service by wasting CPU resources, which may indirectly impact compliance by degrading system performance or availability. However, no direct evidence links it to data breaches or unauthorized access that would violate GDPR or HIPAA.

Mitigation Strategies

Immediately upgrade Nuxt.js to version 3.21.10 or 4.5.1 or later. If upgrading is not possible, restrict access to the /__nuxt_island/ endpoint at the network level to prevent unauthenticated POST requests.

Hi! I’m here to help you understand CVE-2026-71321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70