HIGH 7.5 GitHub
CVE-2026-71314
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
### Impact
An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a `v-for` over a prop (for example `v-for="n in count"` or a `<slot v-for>`). Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props and send the iterated prop as a large integer. The server then expands the `v-for` to that many nodes during SSR, allocating memory proportional to the attacker's number. Reporter
Affected Products
- npm/nuxt >= 4.0.0, < 4.5.1
- npm/nuxt >= 3.1.0, < 3.21.10
References
- https://github.com/advisories/GHSA-hxcr-hm88-mpq6
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6
- https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e
- https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-05 via GitHub. Affected: npm/nuxt >= 4.0.0, < 4.5.1, npm/nuxt >= 3.1.0, < 3.21.10.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.