Loading story…
Nuxt released version 4.5.1 with urgent fixes for multiple security flaws affecting server-side rendering, server islands, and runtime caching. The patched issues include CVE-2026-71314 and CVE-2026-71321, which allow unauthenticated attackers to trigger denial-of-service conditions through the internal /__nuxt_island/ endpoint by forging or sending expensive island rendering requests, exhausting CPU during request-body parsing and hashing, or forcing massive v-for expansions that can crash Node.js with out-of-memory errors. Nuxt added protections including request validation hardening, body-size and parsing guards, and a MAX_VFOR_LENGTH bound to limit server-side loop expansion.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Alongside the security release, Nuxt advised users employing cache, swr, or isr route rules to purge CDN or edge caches after upgrading. The project warned that leaked _payload.json files might already be cached upstream.
The v4.5.1 release introduced a change to reject a top-level "as" prop in server island requests. This mitigated unauthorized component instantiation through Vue attribute fallthrough in island rendering.
The v4.5.1 release added bounds on island props and v-for processing to mitigate unauthenticated denial-of-service conditions in the /__nuxt_island/ handler. The mitigations include guarded body handling, structural checks, and limiting oversized numeric iteration ranges.
As part of the v4.5.1 release, Nuxt changed payload caching so cached payloads are used only in prerendering contexts, disabling runtime payload caching otherwise. This addressed the cross-user payload disclosure issue later tracked as CVE-2026-71316.
Nuxt published version 4.5.1 as a security release and urged users to upgrade immediately. The release fixes multiple vulnerabilities, including unauthorized component instantiation via server island props, server component denial of service, cross-user payload disclosure on cached pages, and other issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcegithub.com
Open sourcenuxt.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw tracked as **`CVE-2026-71320`** allows remote code execution in the Nuxt framework by abusing server island props passed to the ` /__nuxt_island/ ` endpoint when **`vue.runtimeCompiler: true`** is enabled. The bug affects **Nuxt 3.4.0 through before 3.21.10** and **Nuxt 4.0.0 through before 4.5.1**, where attacker-controlled properties from query strings or request bodies could reach the server-side rendering pipeline and inject a dangerous `template` key into dynamic Vue components, leading to template execution inside the Nitro process. The issue is classified under **`CWE-94`** and **`CWE-74`** and carries a high-impact CVSS vector of **`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`**. Nuxt has released fixes in **3.21.10** and **4.5.1** that add deep validation for unsafe island props and reject malicious requests with **HTTP 400** when the runtime compiler is active. The patch introduces a traversal check for the `template` key before props are forwarded into SSR, closing the documented attack path involving dynamic components such as ` <component :is> `. Researchers noted a residual theoretical concern that the validation relies on `Object.keys()` and could be bypassed in a separate prototype-pollution scenario, but the primary mitigation is available now and defenders are also advised to disable **`vue.runtimeCompiler`** in `nuxt.config.ts` where it is not required.
Aug 6, 2026
Nuxt disclosed **CVE-2026-53722**, a reflected DOM-based cross-site scripting flaw in the `<NuxtLink>` component affecting versions before **3.21.7** and **4.4.7**. The bug allowed attacker-controlled values passed into `to` or `href` to be rendered into anchor tags without proper URI scheme sanitization, enabling `javascript:` or `data:` payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into `<NuxtLink>`, and Nuxt fixed it by introducing `sanitizeExternalHref` to block unsafe protocols and abort navigation. Angular also disclosed an SSRF vulnerability in `@angular/platform-server` under **GHSA-rfh7-fxqc-q52v**, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative `HttpClient` requests or `PlatformLocation.hostname` lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include **22.0.0-next.12**, **21.2.13**, **20.3.21**, and **19.2.22**; no fix was listed for the **18.x** line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Jun 29, 2026
Nuxt disclosed **CVE-2026-71315**, a high-severity authorization bypass caused by route rules not matching correctly when applications use case-insensitive routing. In affected versions `3.21.7` through before `3.21.10` and `4.4.7` through before `4.5.1`, mixed-case `routeRules` keys could be silently dropped when `router.options.sensitive` was `false`, allowing `appMiddleware` protections and other path-based controls to fail on differently cased requests. The issue was recorded as an incomplete fix for **CVE-2026-53721** and was mapped to `CWE-178` and `CWE-863`. Nuxt fixed the bug by adding both case-sensitive and case-folded route-rule matchers, selecting behavior at runtime based on router sensitivity, and updating prerender and manifest handling so mixed-case keys are applied consistently. The vendor shipped the remediation in **Nuxt `3.21.10` and `4.5.1`**, alongside tests covering middleware, redirects, SSR, and prerender behavior across request casing, and said users who previously upgraded for the earlier advisory still need this release because the prior route-rule fix introduced a regression. The `v3.21.10` security release also bundled fixes for additional issues, including server-side RCE, unauthorized server-island component instantiation, server component denial of service, and development server path disclosure.
Aug 6, 2026