Executive brief
Nuxt, a popular web framework, contains a vulnerability in its internal component rendering system. An attacker can send a specially crafted, large request to a specific server endpoint that forces the server to spend excessive time processing the data before realizing the request is invalid. Because the server handles tasks one at a time, this can cause the entire website to become slow or completely unresponsive for all users, even with a relatively small number of malicious requests.
Technical details
The vulnerability exists in the internal island renderer endpoint (`/__nuxt_island/...`) which decodes and hashes attacker-controlled request input before validating the URL-resident hash. An unauthenticated attacker can send a POST request with a large JSON body (e.g., ~4.6 MB with 150k keys) which is fully read, parsed via `destr`, and processed through `ohash` before being rejected. Since the Nitro server runs on a single event loop, this synchronous processing blocks the event loop, leading to a Denial of Service (DoS) even at low request rates. The fix, available in versions 4.5.1 and 3.21.10, introduces a raw body-size cap (413) and a JSON nesting-depth cap (400) to reject oversized inputs before expensive parsing occurs.
Affected products
- Nuxt nuxt >= 4.0.0, < 4.5.1
- Nuxt nuxt >= 3.1.0, < 3.21.10
Timeline
- 2026-07-27: disclosed: Initial disclosure to vendor
- 2026-08-05: advisory: GitHub Advisory published
- 2026-08-05: patched: Fixes released in versions 4.5.1 and 3.21.10