Skip to content

Instantly share code, notes, and snippets.

@alon710
Last active August 5, 2026 21:30
Show Gist options
  • Select an option

  • Save alon710/ea06609eb056fc8864effae3b0dc1b95 to your computer and use it in GitHub Desktop.

Select an option

Save alon710/ea06609eb056fc8864effae3b0dc1b95 to your computer and use it in GitHub Desktop.
CVE-2026-71314: CVE-2026-71314: Out-of-Memory Denial of Service via Unbounded v-for Expansion in Nuxt Server Islands - CVE Security Report

CVE-2026-71314: CVE-2026-71314: Out-of-Memory Denial of Service via Unbounded v-for Expansion in Nuxt Server Islands

CVSS Score: 7.5 Published: 2026-08-05 Full Report: https://cvereports.com/reports/CVE-2026-71314

Summary

An unauthenticated remote denial of service (DoS) vulnerability exists in Nuxt's server component ('island') rendering mechanism. Due to a deterministic signature generation scheme and missing input constraints on server-side v-for directive expansion, an attacker can trigger unconstrained memory allocations on the hosting Node.js server, leading to immediate process crash.

TL;DR

Unauthenticated remote attackers can crash Nuxt applications via a single crafted request that exploits unbounded loop expansion in server components.

Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS Score: 7.5
  • Impact: Availability (Denial of Service)
  • Exploit Status: poc
  • CISA KEV Status: No

Affected Systems

  • Nuxt web applications utilizing Server Components (Islands)
  • Nuxt: >= 3.1.0, < 3.21.10 (Fixed in: 3.21.10)
  • Nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Mitigation

  • Upgrade Nuxt to version 3.21.10 or 4.5.1
  • Disable experimental server component islands in nuxt.config.ts if unused
  • Apply reverse proxy or WAF request body size limits of 64KB on island endpoints
  • Implement strict rate limiting on the /__nuxt_island/ URL pattern

Remediation Steps:

  1. Audit package.json to identify the active Nuxt version in the project.
  2. Execute the update package manager command: npm install nuxt@3.21.10 (or yarn/pnpm equivalent).
  3. Verify the configuration of componentIslands in nuxt.config.ts and disable if unnecessary.
  4. Deploy and verify reverse proxy request restriction policies in staging prior to production push.

References


Generated by CVEReports - Automated Vulnerability Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment