Vulnerability in Nuxt Web Development Framework Affects Multiple Versions
CVE-2026-71318

4.8MEDIUM

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
5 August 2026

What is CVE-2026-71318?

A security issue exists in Nuxt, an open-source framework for Vue.js, where improper input validation allows an attacker to supply a top-level as prop to the /__nuxt_island/ endpoint. This can lead to unauthorized dynamic component resolution through various methods such as , resolveDynamicComponent, or h(). The vulnerability has been addressed in releases 3.21.10 and 4.5.1, ensuring enhanced security for users upgrading to these versions.

Affected Version(s)

nuxt >= 4.0.0, < 4.5.1 < 4.0.0, 4.5.1

nuxt >= 3.1.0, < 3.21.10 < 3.1.0, 3.21.10

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-48h...
x_refsource_CONFIRM
https://github.com/nuxt/nuxt/releases/tag/v3.21.10
x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.