Unauthenticated Memory Allocation Vulnerability in Nuxt Framework by Nuxt
CVE-2026-71314

7.5HIGH

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71314?

The Nuxt Framework versions from 3.1.0 to 3.21.10 and 4.5.1 are susceptible to a vulnerability that allows unauthenticated attackers to exploit server island v-for props. By leveraging this weakness, attackers can cause unbounded server-side rendering (SSR) memory allocation, leading to potential process crashes. This vulnerability underscores the importance of keeping frameworks up-to-date to safeguard against unauthorized access and maintain application stability.

Affected Version(s)

nuxt >= 4.0.0, < 4.5.1 < 4.0.0, 4.5.1

nuxt >= 3.1.0, < 3.21.10 < 3.1.0, 3.21.10

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-hxc...
x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e...
x_refsource_MISC
https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.