CVE-2026-71314

HIGH 7.5

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

CWE	CWE-400 CWE-770 CWE-789 CWE-1284
Vendor	nuxt
Product	nuxt
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for nuxt nuxt

Be the first to know when new high vulnerabilities affecting nuxt nuxt are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

nuxt / nuxt

>= 4.0.0, < 4.5.1 >= 3.1.0, < 3.21.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6 github.com: https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e github.com: https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22 github.com: https://github.com/nuxt/nuxt/releases/tag/v3.21.10 github.com: https://github.com/nuxt/nuxt/releases/tag/v4.5.1