Loading story…
A critical flaw tracked as CVE-2026-71320 allows remote code execution in the Nuxt framework by abusing server island props passed to the /__nuxt_island/ endpoint when vue.runtimeCompiler: true is enabled. The bug affects Nuxt 3.4.0 through before 3.21.10 and Nuxt 4.0.0 through before 4.5.1, where attacker-controlled properties from query strings or request bodies could reach the server-side rendering pipeline and inject a dangerous template key into dynamic Vue components, leading to template execution inside the Nitro process. The issue is classified under CWE-94 and CWE-74 and carries a high-impact CVSS vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Nuxt has released fixes in 3.21.10 and 4.5.1 that add deep validation for unsafe island props and reject malicious requests with HTTP 400 when the runtime compiler is active. The patch introduces a traversal check for the template key before props are forwarded into SSR, closing the documented attack path involving dynamic components such as <component :is>. Researchers noted a residual theoretical concern that the validation relies on Object.keys() and could be bypassed in a separate prototype-pollution scenario, but the primary mitigation is available now and defenders are also advised to disable vue.runtimeCompiler in nuxt.config.ts where it is not required.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisory GHSA-9473-5f9j-94wq received the new CVE-2026-71320 entry for a Nuxt server-side remote code execution issue involving runtime template injection in server island props. The CVE describes affected Nuxt versions 3.4.0 through before 3.21.10 and 4.0.0 through before 4.5.1.
Nuxt patched an unsafe server-side rendering path involving /__nuxt_island/ props by adding validation that detects a dangerous "template" key and rejects such requests with HTTP 400 when vue.runtimeCompiler is enabled. The fix was released in Nuxt versions 3.21.10 and 4.5.1, with referenced remediation commits and release pages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nuxt released **version 4.5.1** with urgent fixes for multiple security flaws affecting server-side rendering, server islands, and runtime caching. The patched issues include **CVE-2026-71314** and **CVE-2026-71321**, which allow unauthenticated attackers to trigger denial-of-service conditions through the internal ` /__nuxt_island/ ` endpoint by forging or sending expensive island rendering requests, exhausting CPU during request-body parsing and hashing, or forcing massive `v-for` expansions that can crash Node.js with out-of-memory errors. Nuxt added protections including request validation hardening, body-size and parsing guards, and a `MAX_VFOR_LENGTH` bound to limit server-side loop expansion.
Aug 6, 2026
Nuxt disclosed **CVE-2026-53722**, a reflected DOM-based cross-site scripting flaw in the `<NuxtLink>` component affecting versions before **3.21.7** and **4.4.7**. The bug allowed attacker-controlled values passed into `to` or `href` to be rendered into anchor tags without proper URI scheme sanitization, enabling `javascript:` or `data:` payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into `<NuxtLink>`, and Nuxt fixed it by introducing `sanitizeExternalHref` to block unsafe protocols and abort navigation. Angular also disclosed an SSRF vulnerability in `@angular/platform-server` under **GHSA-rfh7-fxqc-q52v**, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative `HttpClient` requests or `PlatformLocation.hostname` lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include **22.0.0-next.12**, **21.2.13**, **20.3.21**, and **19.2.22**; no fix was listed for the **18.x** line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Jun 29, 2026
Nuxt disclosed **CVE-2026-71315**, a high-severity authorization bypass caused by route rules not matching correctly when applications use case-insensitive routing. In affected versions `3.21.7` through before `3.21.10` and `4.4.7` through before `4.5.1`, mixed-case `routeRules` keys could be silently dropped when `router.options.sensitive` was `false`, allowing `appMiddleware` protections and other path-based controls to fail on differently cased requests. The issue was recorded as an incomplete fix for **CVE-2026-53721** and was mapped to `CWE-178` and `CWE-863`. Nuxt fixed the bug by adding both case-sensitive and case-folded route-rule matchers, selecting behavior at runtime based on router sensitivity, and updating prerender and manifest handling so mixed-case keys are applied consistently. The vendor shipped the remediation in **Nuxt `3.21.10` and `4.5.1`**, alongside tests covering middleware, redirects, SSR, and prerender behavior across request casing, and said users who previously upgraded for the earlier advisory still need this release because the prior route-rule fix introduced a regression. The `v3.21.10` security release also bundled fixes for additional issues, including server-side RCE, unauthorized server-island component instantiation, server component denial of service, and development server path disclosure.
Aug 6, 2026