Denial of Service Vulnerability in Nuxt Web Development Framework
CVE-2026-128074

6.9MEDIUM

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128074?

The Nuxt framework, versions 4.6.0 through 4.6.4, contains a Denial of Service vulnerability due to inefficiencies in the generation of the _payload.json URL and handling of the experimental early-404 path. An unauthenticated attacker can exploit this vulnerability by sending specially crafted requests, causing synchronous occupancy of the Node.js event loop. This results in a significant delay in processing other requests, thereby affecting the availability of applications that utilize Incremental Static Regeneration (ISR), Static Site Generation (SSG), cache route rules, or have the experimental early-404 functionality enabled. Applications relying on fully prerendered content or operating as client-only are not affected. This issue has been remediated in version 4.6.4.

Affected Version(s)

nuxt >= 4.6.0, < 4.6.4

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-r9j...
x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/97424dd21c59b60cc7ece...
x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.6.4
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.