CVE-2026-71321

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e
https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22
https://github.com/nuxt/nuxt/releases/tag/v3.21.10
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-05 22:17

Updated : 2026-09-08 20:51

NVD link : CVE-2026-71321

Mitre link : CVE-2026-71321

CVE.ORG link : CVE-2026-71321

JSON object : View

Products Affected

No product.

CWE

CWE-407

Inefficient Algorithmic Complexity

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-71321", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71321", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:44:48.051188Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nuxt", "product": "nuxt", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.5.1"}, {"status": "affected", "version": ">= 3.1.0, < 3.21.10"}]}]}], "published": "2026-08-05T22:17:08.507", "references": [{"url": "https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt/nuxt/releases/tag/v3.21.10", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt/nuxt/releases/tag/v4.5.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-407"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1."}], "lastModified": "2026-09-08T20:51:43.490", "sourceIdentifier": "security-advisories@github.com"}