CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer

Vulnerability ID: CVE-2026-71321
CVSS Score: 7.5
Published: 2026-08-05

An unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.

TL;DR

Unauthenticated POST requests with massive or deeply nested JSON to Nuxt's internal island endpoint block the single-threaded Node.js event loop, causing a complete denial of service before verifying cryptographic signatures.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-407 / CWE-770
• Attack Vector: Network
• CVSS v3.1: 7.5 (High)
• Exploit Status: Proof-of-Concept Available
• KEV Status: Not Listed
• Impact: Denial of Service (CPU Exhaustion)

Affected Systems

• Nuxt Framework versions 3.x prior to 3.21.10
• Nuxt Framework versions 4.x prior to 4.5.1
• nuxt: >= 3.1.0, < 3.21.10 (Fixed in: 3.21.10)
• nuxt: >= 4.0.0, < 4.5.1 (Fixed in: 4.5.1)

Code Analysis

Commit: 4e35ae9

Nitro Island Handler input sanitization and verification rewrite.

Commit: 668cdfd

Additional guards and limits for island endpoint properties.

Exploit Details

• GitHub Security Advisory: Primary advisory listing vulnerability mechanisms and remediation pathways.

Mitigation Strategies

• Upgrade Nuxt to version 3.21.10, 4.5.1, or higher.
• Implement request body size limits at the reverse proxy or WAF layer specifically for the island endpoint path.
• Deploy rate limiting on Nuxt island rendering paths to mitigate rapid-fire POST attacks.

Remediation Steps:

1. Identify any deployed applications running vulnerable versions of Nuxt (3.1.0 to 3.21.9, or 4.0.0 to 4.5.0).
2. Update the dependency configuration in package.json to reference a secure version (e.g., ^3.21.10 or ^4.5.1).
3. Run the corresponding package manager install command (e.g., npm install, yarn install, or pnpm install) to apply the update.
4. Validate the deployed environment behavior by verifying that payloads over 64KB on the island endpoint return an HTTP 413 error status code.

References

• Nuxt Security Advisory (Primary source)
• Core Fix Commit (Nitro Island Handler)
• Secondary Fix Commit (Nitro Island Handler)
• Nuxt v3.x Patched Release Notes
• Nuxt v4.x Patched Release Notes

Read the full report for CVE-2026-71321 on our website for more details including interactive diagrams and full exploit analysis.