CVE-2026-71314: CVE-2026-71314: Out-of-Memory Denial of Service via Unbounded v-for Expansion in Nuxt Server Islands
CVSS Score: 7.5 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71314
An unauthenticated remote denial of service (DoS) vulnerability exists in Nuxt's server component ('island') rendering mechanism. Due to a deterministic signature generation scheme and missing input constraints on server-side v-for directive expansion, an attacker can trigger unconstrained memory allocations on the hosting Node.js server, leading to immediate process crash.
Unauthenticated remote attackers can crash Nuxt applications via a single crafted request that exploits unbounded loop expansion in server components.
- CWE ID: CWE-400
- Attack Vector: Network
- CVSS Score: 7.5
- Impact: Availability (Denial of Service)
- Exploit Status: poc
- CISA KEV Status: No
- Nuxt web applications utilizing Server Components (Islands)
- Nuxt: >= 3.1.0, < 3.21.10 (Fixed in:
3.21.10) - Nuxt: >= 4.0.0, < 4.5.1 (Fixed in:
4.5.1)
- Upgrade Nuxt to version 3.21.10 or 4.5.1
- Disable experimental server component islands in nuxt.config.ts if unused
- Apply reverse proxy or WAF request body size limits of 64KB on island endpoints
- Implement strict rate limiting on the /__nuxt_island/ URL pattern
Remediation Steps:
- Audit package.json to identify the active Nuxt version in the project.
- Execute the update package manager command: npm install nuxt@3.21.10 (or yarn/pnpm equivalent).
- Verify the configuration of componentIslands in nuxt.config.ts and disable if unnecessary.
- Deploy and verify reverse proxy request restriction policies in staging prior to production push.
Generated by CVEReports - Automated Vulnerability Intelligence