CVE-2026-71318 in Nuxt
Summary
by MITRE • 08/06/2026
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability affects the Nuxt.js web development framework which serves as a server-side rendering solution built on top of Vue.js. The flaw exists in versions ranging from 3.1.0 through 3.21.9 and 4.0.0 through 4.5.0, creating a critical security risk that allows remote code execution through improper input validation. Attackers can exploit this weakness by supplying a specially crafted `as` prop to the `/__nuxt_island/` endpoint, which then gets processed through Vue.js dynamic component resolution mechanisms.
The technical implementation of this vulnerability relies on the framework's handling of dynamic components where the `as` prop parameter directly influences how Vue.js resolves component names. When an attacker provides malicious input through this parameter, it gets passed through the `<component :is>` directive, `resolveDynamicComponent` function, or `h()` render function without proper sanitization or validation. This creates a path where arbitrary component names can be resolved and executed within the server context, effectively bypassing normal security boundaries. The vulnerability maps directly to CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and specifically addresses cases where dynamic code execution occurs through user-controllable inputs.
The operational impact of this vulnerability is severe as it enables remote code execution on affected servers, potentially allowing attackers to execute arbitrary commands, access sensitive data, or compromise the entire application infrastructure. The attack surface is particularly concerning because Nuxt.js applications often run in production environments where such vulnerabilities can be exploited without authentication requirements. The issue affects both version 3.x and 4.x branches of the framework, indicating it's a fundamental flaw in how dynamic component resolution is handled across major releases.
Security mitigations for this vulnerability require immediate patching to versions 3.21.10 or 4.5.1 where the fix has been implemented. Organizations should also implement additional defensive measures including input validation at the application level, web application firewalls that can detect and block suspicious `as` parameter values, and monitoring for unusual patterns in component resolution requests. The fix addresses the core issue by implementing proper sanitization of the `as` prop parameter before it reaches the dynamic component resolution functions. This aligns with ATT&CK technique T1059.007 which covers "Command and Scripting Interpreter: JavaScript', and represents a critical security control failure that could enable lateral movement within affected environments. System administrators should prioritize immediate deployment of patched versions while maintaining vigilance for potential exploitation attempts in their logs.