What is the CVSS score of CVE-2026-71321?

CVE-2026-71321 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Nuxt are affected by CVE-2026-71321?

Nuxt web framework versions 3.1.0-3.21.9 and 4.0.0-4.5.0 are vulnerable to unauthenticated denial-of-service attacks that can crash or degrade all web services built on these platforms.. A patch is available.

Is there a public PoC exploit available for CVE-2026-71321?

Yes, a public proof-of-concept exploit is available for CVE-2026-71321. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-71321?

Within 24 hours, immediately inventory all applications using Nuxt framework versions 3.1.0-3.21.9 (version 3 line) and 4.0.0-4.5.0 (version 4 line), and obtain patch versions from Nuxt's official security advisory. Within 7 days, deploy available patches to all affected applications, prioritizing customer-facing systems and validating in staging environments first. Within 30 days, complete rollout to all production systems, confirm full functionality, and configure monitoring rules to detect and alert on potential exploitation attempts targeting the /__nuxt_island/ endpoint.

Nuxt CVE-2026-71321

EUVD-2026-53658 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-08-05 https://github.com/nuxt/nuxt

GHSA-9pgf-384g-p7mv

Information Disclosure

7.5

CVSS 3.1 · Vendor: https://github.com/nuxt/nuxt

Severity by source

Vendor (https://github.com/nuxt/nuxt) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable endpoint, no authentication or special conditions required, single-event-loop stall causes high availability impact with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/nuxt/nuxt).

CVSS VectorVendor: https://github.com/nuxt/nuxt

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 22:01 vuln.today

Analysis Generated

Aug 05, 2026 - 22:01 vuln.today

CVE Published

Aug 05, 2026 - 21:43 github-advisory

HIGH 7.5

DescriptionCVE.org

Impact

The internal island renderer endpoint (/__nuxt_island/...) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /__nuxt_island/<name>_<anything>.json with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, destr-parsed, and run through ohash before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low request rate is enough to degrade or stall the server. No valid hash and no authentication are required.

Patches

Fixed in nuxt@4.5.1 and nuxt@3.21.10. The island handler now enforces a raw body-size cap (413) and a JSON nesting-depth cap (400) before parsing or hashing, so oversized or deeply nested input is rejected cheaply.

Workarounds

Put a small request-body limit in front of /__nuxt_island/ at your reverse proxy / edge (islands legitimately send only a compact props payload), or disable server components if unused.

AnalysisAI

Unauthenticated CPU exhaustion in Nuxt's island renderer endpoint allows remote attackers to degrade or stall server availability without any credentials or valid hash. Nuxt versions 3.1.0-3.21.9 and 4.0.0-4.5.0 are affected: the /__nuxt_island/ handler fully buffers, destr-parses, and ohash-hashes attacker-supplied POST bodies before checking the URL-embedded hash token, meaning expensive computation runs on doomed requests. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Send unauthenticated POST to /__nuxt_island/<name>_<any>.json

Delivery

Attach oversized ~4.6 MB JSON body with 150k keys

Exploit

Server streams and buffers full body with no size gate

Install

destr parses entire payload

ohash hashes parsed object

Execute

Request rejected 400 after full CPU cost paid

Impact

Event loop blocked, concurrent requests stall

Recon

Send unauthenticated POST to /__nuxt_island/<name>_<any>.json

Delivery

Attach oversized ~4.6 MB JSON body with 150k keys

Exploit

Server streams and buffers full body with no size gate

Install

destr parses entire payload

ohash hashes parsed object

Execute

Request rejected 400 after full CPU cost paid

Impact

Event loop blocked, concurrent requests stall

Vulnerability AssessmentAI

Exploitation	No special conditions are required beyond the target running a vulnerable Nuxt version (3.1.0-3.21.9 or 4.0.0-4.5.0) in server-side rendering mode with the island/server-component feature active, which is the default for projects using Nuxt server components. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflect the threat model: fully unauthenticated, network-reachable, low-complexity, no user interaction - availability impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a continuous low-rate stream of unauthenticated POST requests to `/__nuxt_island/anything_x.json` on a public-facing Nuxt server, each carrying a ~4.6 MB JSON body with roughly 150,000 keys. The server fully buffers each body, runs destr's parser over all keys, and executes ohash before rejecting the request with 400 - CPU-bound work runs entirely on Node.js's single event loop, stalling every other pending HTTP request for its duration. …
Remediation	Upgrade to nuxt@4.5.1 for v4 users or nuxt@3.21.10 for v3 users; both releases are confirmed by GitHub advisory GHSA-9pgf-384g-p7mv (https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv) and available via npm. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, immediately inventory all applications using Nuxt framework versions 3.1.0-3.21.9 (version 3 line) and 4.0.0-4.5.0 (version 4 line), and obtain patch versions from Nuxt's official security advisory. …

Threat intelligence, references, and detailed analysis are available after sign-in.