Is CVE-2026-71318 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71318 being exploited in the wild.

How severe is CVE-2026-71318?

Medium severity, with a CVSS score of 4.8, published 5 August 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.5.1.

Is there a fix for CVE-2026-71318?

Yes. nuxt (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71318 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71318?

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71318: Nuxt unauthorized component instantiation in Server Islands

CVE-2026-71318 · Severity: medium · CVSS 4.8 · Published 2026-08-05

Nuxt server islands are a feature that enables server-side rendering of Vue components. When an application uses a server island component that forwards untrusted input, an attacker can instantiate arbitrary globally-registered Vue components or native HTML elements (such as iframes). This could allow information disclosure or enable HTML injection attacks, depending on which components are available in the application's registry.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-71318 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71318 being exploited in the wild.
How severe is CVE-2026-71318?: Medium severity, with a CVSS score of 4.8, published 5 August 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.5.1.
Is there a fix for CVE-2026-71318?: Yes. nuxt (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71318 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71318?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.5.1 or later
```
npm install nuxt@4.5.1
```

Technical details

This vulnerability exists in Nuxt's server island implementation, which accepts props via the /__nuxt_island/ endpoint. The root cause is improper validation of untrusted prop values when they are forwarded to Vue's dynamic component resolution mechanisms (<component :is>, resolveDynamicComponent, or h()). An attacker can pass a plain string value (rather than a component definition object) to trigger component resolution. When an island component's root is a polymorphic component (like those from @nuxt/ui via reka-ui) that exposes an "as" prop, undeclared island props automatically fall through as attributes, allowing the attacker's string to reach the dynamic component sink without explicit prop forwarding. The attacker is limited to instantiating components already in the island app's global registry or rendering native HTML elements. Arbitrary JavaScript execution is not possible since this vector does not involve template/render compilation. Patches released in Nuxt 3.21.10 and 4.5.1 reject top-level "as" island props at the /__nuxt_island/ endpoint (HTTP 400), blocking the implicit attribute-fallthrough path.

Affected products

Nuxt Nuxt >=3.1.0 <3.21.10, >=4.0.0 <4.5.1

Identifiers

CVE-2026-71318
GHSA-48hr-524c-v5w3

Timeline

2026-08-05: disclosed
2026-07-27: patched: Patches released in Nuxt 3.21.10 and 4.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.