EUVD-2026-53658
GHSA-9pgf-384g-p7mv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable endpoint, no authentication or special conditions required, single-event-loop stall causes high availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (https://github.com/nuxt/nuxt).
CVSS VectorVendor: https://github.com/nuxt/nuxt
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Impact
The internal island renderer endpoint (/__nuxt_island/...) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /__nuxt_island/<name>_<anything>.json with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, destr-parsed, and run through ohash before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low request rate is enough to degrade or stall the server. No valid hash and no authentication are required.
Patches
Fixed in nuxt@4.5.1 and nuxt@3.21.10. The island handler now enforces a raw body-size cap (413) and a JSON nesting-depth cap (400) before parsing or hashing, so oversized or deeply nested input is rejected cheaply.
Workarounds
Put a small request-body limit in front of /__nuxt_island/ at your reverse proxy / edge (islands legitimately send only a compact props payload), or disable server components if unused.
AnalysisAI
Unauthenticated CPU exhaustion in Nuxt's island renderer endpoint allows remote attackers to degrade or stall server availability without any credentials or valid hash. Nuxt versions 3.1.0-3.21.9 and 4.0.0-4.5.0 are affected: the /__nuxt_island/ handler fully buffers, destr-parses, and ohash-hashes attacker-supplied POST bodies before checking the URL-embedded hash token, meaning expensive computation runs on doomed requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target running a vulnerable Nuxt version (3.1.0-3.21.9 or 4.0.0-4.5.0) in server-side rendering mode with the island/server-component feature active, which is the default for projects using Nuxt server components. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflect the threat model: fully unauthenticated, network-reachable, low-complexity, no user interaction - availability impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a continuous low-rate stream of unauthenticated POST requests to `/__nuxt_island/anything_x.json` on a public-facing Nuxt server, each carrying a ~4.6 MB JSON body with roughly 150,000 keys. The server fully buffers each body, runs destr's parser over all keys, and executes ohash before rejecting the request with 400 - CPU-bound work runs entirely on Node.js's single event loop, stalling every other pending HTTP request for its duration. … |
| Remediation | Upgrade to nuxt@4.5.1 for v4 users or nuxt@3.21.10 for v3 users; both releases are confirmed by GitHub advisory GHSA-9pgf-384g-p7mv (https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv) and available via npm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately inventory all applications using Nuxt framework versions 3.1.0-3.21.9 (version 3 line) and 4.0.0-4.5.0 (version 4 line), and obtain patch versions from Nuxt's official security advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today