{"vulnerability": "cve-2026-71314", "sightings": [{"uuid": "47304772-b3a5-44b5-8514-78df372d7578", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71314", "type": "seen", "source": "https://gist.github.com/alon710/ea06609eb056fc8864effae3b0dc1b95", "content": "# CVE-2026-71314: CVE-2026-71314: Out-of-Memory Denial of Service via Unbounded v-for Expansion in Nuxt Server Islands\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71314\n\n## Summary\nAn unauthenticated remote denial of service (DoS) vulnerability exists in Nuxt's server component ('island') rendering mechanism. Due to a deterministic signature generation scheme and missing input constraints on server-side v-for directive expansion, an attacker can trigger unconstrained memory allocations on the hosting Node.js server, leading to immediate process crash.\n\n## TL;DR\nUnauthenticated remote attackers can crash Nuxt applications via a single crafted request that exploits unbounded loop expansion in server components.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **Impact**: Availability (Denial of Service)\n- **Exploit Status**: poc\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- Nuxt web applications utilizing Server Components (Islands)\n- **Nuxt**: >= 3.1.0, < 3.21.10 (Fixed in: `3.21.10`)\n- **Nuxt**: >= 4.0.0, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade Nuxt to version 3.21.10 or 4.5.1\n- Disable experimental server component islands in nuxt.config.ts if unused\n- Apply reverse proxy or WAF request body size limits of 64KB on island endpoints\n- Implement strict rate limiting on the /__nuxt_island/ URL pattern\n\n**Remediation Steps:**\n1. Audit package.json to identify the active Nuxt version in the project.\n2. Execute the update package manager command: npm install nuxt@3.21.10 (or yarn/pnpm equivalent).\n3. Verify the configuration of componentIslands in nuxt.config.ts and disable if unnecessary.\n4. Deploy and verify reverse proxy request restriction policies in staging prior to production push.\n\n## References\n\n- [GitHub Security Advisory GHSA-hxcr-hm88-mpq6](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6)\n- [Nuxt Release 3.21.10](https://github.com/nuxt/nuxt/releases/tag/v3.21.10)\n- [Nuxt Release 4.5.1](https://github.com/nuxt/nuxt/releases/tag/v4.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71314) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-05T21:31:30.582239Z"}, {"uuid": "a81b1c48-27f7-430a-b47b-61f0d0d66de3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71314", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msejmrvz752z", "content": "\ud83d\udfe0 CVE-2026-71314 - High (7.5)\n\nNuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71314/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T22:00:17.843186Z"}]}