Denial of Service Vulnerability in Nuxt Framework by Nuxt.js
CVE-2026-71321
7.5HIGH
What is CVE-2026-71321?
A Denial of Service vulnerability exists in the Nuxt Framework affecting versions 3.1.0 through 3.21.10 and 4.5.1. The internal island renderer endpoint /__nuxt_island/... is susceptible to an attack where an unauthenticated POST /__nuxt_island/_.json request containing a large JSON body is processed, consuming substantial CPU resources on a Nitro single event loop. This parsing and hashing of the JSON input occurs without proper authentication or valid hash checks, leading to resource exhaustion and delayed handling of concurrent requests. The issue has been rectified in the updates to versions 3.21.10 and 4.5.1.
Affected Version(s)
nuxt >= 4.0.0, < 4.5.1 < 4.0.0, 4.5.1
nuxt >= 3.1.0, < 3.21.10 < 3.1.0, 3.21.10