CVE-2026-71321: CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer - CVE Security Report

CVE-2026-71321.md

CVE-2026-71321: CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer

CVSS Score: 7.5 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71321

Summary

An unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.

TL;DR

Unauthenticated POST requests with massive or deeply nested JSON to Nuxt's internal island endpoint block the single-threaded Node.js event loop, causing a complete denial of service before verifying cryptographic signatures.

Exploit Status: POC

Technical Details

• CWE ID: CWE-407 / CWE-770
• Attack Vector: Network
• CVSS v3.1: 7.5 (High)
• Exploit Status: Proof-of-Concept Available
• KEV Status: Not Listed
• Impact: Denial of Service (CPU Exhaustion)

Affected Systems

• Nuxt Framework versions 3.x prior to 3.21.10
• Nuxt Framework versions 4.x prior to 4.5.1
• nuxt: >= 3.1.0, < 3.21.10 (Fixed in: 3.21.10)
• nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Mitigation

• Upgrade Nuxt to version 3.21.10, 4.5.1, or higher.
• Implement request body size limits at the reverse proxy or WAF layer specifically for the island endpoint path.
• Deploy rate limiting on Nuxt island rendering paths to mitigate rapid-fire POST attacks.

Remediation Steps:

1. Identify any deployed applications running vulnerable versions of Nuxt (3.1.0 to 3.21.9, or 4.0.0 to 4.5.0).
2. Update the dependency configuration in package.json to reference a secure version (e.g., ^3.21.10 or ^4.5.1).
3. Run the corresponding package manager install command (e.g., npm install, yarn install, or pnpm install) to apply the update.
4. Validate the deployed environment behavior by verifying that payloads over 64KB on the island endpoint return an HTTP 413 error status code.

References

• Nuxt Security Advisory (Primary source)
• Core Fix Commit (Nitro Island Handler)
• Secondary Fix Commit (Nitro Island Handler)
• Nuxt v3.x Patched Release Notes
• Nuxt v4.x Patched Release Notes

---

Generated by CVEReports - Automated Vulnerability Intelligence