High severity · published Aug 5, 2026
CVE-2026-71321
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
nuxt · nuxt
>= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71321
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71321
github.com
https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e
github.com
https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22
github.com
https://github.com/nuxt/nuxt/releases/tag/v3.21.10
github.com
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
github.com
https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv
More from nuxt
9.8
CVE-2023-3224
Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3
8.8
CVE-2024-34344
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.8
CVE-2024-23657
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js
8.2
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
8.2
CVE-2026-53721
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher