CVE -2026-71314 exposes a critical vulnerability in Nuxt that could lead to a server crash without requiring a user to log in. The issue concerns the way dynamic lists are rendered on server islands and has been fixed in newer versions of the framework.
The vulnerability was reported with a CVSS score of 10.0 and could allow a remote, unidentified attacker to send specially crafted data to applications using islands or server components. The official Nuxt security bulletin describes a low-sophistication attack, without privileges or user interaction.
See also: JavaScript malware: malvertising that assembles payload in browser memory
CVE-2026-71314: How the vulnerability manifests itself
The issue is found in a server component that contains a v-for on a property that is controlled by the request. An example is a list that iterates based on the value count, as well as a slot that uses v-for. The platform was calculating the number of elements without a sufficient upper bound.
The attacker can calculate the hash of the island, since it is not a secret, and submit a particularly large integer as a property. The server then attempts to create a corresponding number of nodes during HTML rendering, allocating memory proportional to the value provided.
In tests published by the Nuxt team, a request of approximately 130 bytes with a count =40000000 caused a memory exhaustion and worker termination. Similar behavior was observed in a slot list with millions of elements, which makes CVE-2026-71314 an immediate availability risk.
Which versions of Nuxt are affected?
The vulnerability affects Nuxt versions 3.1.0 through 3.21.10 and Nuxt branch 4.0.0 through 4.5.1. The attack requires an application that renders a server island or server component with iterating over an input property; simply installing the framework is not enough.
The fixes limit the number of iterations to 100,000 nodes at the performance limit and cover both the regular v-for and the vforToArray. Nuxt warns that a body size limit in front of /__nuxt_island/ does not address all forms of the attack.
The official assessment rates CVE-2026-71314 as high severity, with full availability impact and no confidentiality or integrity impact. Because the request may be very small, the resource consumption is not necessarily noticeable by simple filters that only look at the body size.
The Nuxt technical team notes that the attack does not require stolen credentials, a special account, or any action by a visitor. It only requires that an appropriate island endpoint be accessible and that there is an iterator that derives its value from a property. Applications without this usage are not affected in the same way.
Development teams should monitor logs for unusual requests to /__nuxt_island/, large values in retry parameters, and repeated worker restarts. This monitoring does not prove an attack, but it can help identify services that need immediate upgrades.
Nuxt 3.21.10 and its corresponding 4.5.1 release are marked as security releases by the maintainer. The fixes are part of a broader set of changes around server islands, so testing in a staging environment is required before deploying to production.
See also: SearchLeak: Application vulnerability exposes corporate data
The recommended update
Administrators should immediately upgrade to Nuxt 3.21.10 or Nuxt 4.5.1, depending on the branch they are using. The official security releases recommend running the command npx nuxt upgrade --dedupe, to update the lockfile and get the relevant dependency fixes.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Infected npm packages trigger RAT when imported into Node.js
Until the upgrade is complete, developers can explicitly limit the values fed into each iteration, for example with Math.min(count, 1000). The workaround reduces exposure, but is not a substitute for installing the patched versions, as CVE-2026-71314 concerns the checksum in the rendering process itself.
