CVE-2026-71314 PUBLISHED

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Assigner: GitHub_M
Reserved: 05.08.2026 Published: 05.08.2026 Updated: 06.08.2026

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor nuxt
Product nuxt
Versions
  • Version >= 4.0.0, < 4.5.1 is affected
  • Version >= 3.1.0, < 3.21.10 is affected

References

Problem Types

  • CWE-400: Uncontrolled Resource Consumption CWE
  • CWE-770: Allocation of Resources Without Limits or Throttling CWE
  • CWE-789: Memory Allocation with Excessive Size Value CWE
  • CWE-1284: Improper Validation of Specified Quantity in Input CWE