CVE-2026-71314: Nuxt denial of service via unbounded v-for expansion in island rendering

Executive brief

Nuxt, a popular framework for building web applications, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a specially crafted request that forces the server to allocate an excessive amount of memory, leading to a system crash. This can disrupt business operations by making the website or application unavailable to legitimate users.

Technical details

Nuxt is vulnerable to uncontrolled resource consumption (CWE-400) within its island rendering engine. The vulnerability exists because the island URL hash is a non-secret digest, allowing an attacker to compute valid hashes for arbitrary props. By sending a large integer as a prop to a component using 'v-for' (e.g., v-for='n in count'), the server attempts to expand the loop into millions of nodes during Server-Side Rendering (SSR). This results in excessive memory allocation and an out-of-memory (OOM) crash of the worker process. The issue affects both Vue's 'ssrRenderList' and the 'vforToArray' slot helper. Patches in versions 4.5.1 and 3.21.10 introduce a 'MAX_VFOR_LENGTH' clamp of 100,000 iterations to mitigate this amplification.

Affected products

• Nuxt Nuxt >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10

Timeline

• 2026-07-27: disclosed
• 2026-08-05: advisory
• 2026-08-05: patched

References

• https://api.github.com/users/manop55555
• https://github.com/manop55555
• https://api.github.com/users/manop55555/gists%7B/gist_id%7D
• https://api.github.com/users/manop55555/repos
• https://avatars.githubusercontent.com/u/109808848?v=4
• https://api.github.com/users/manop55555/events%7B/privacy%7D