CVE-2026-71321 in Nuxt
Summary
by MITRE • 08/06/2026
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability described affects Nuxt.js framework versions between 3.1.0 and 3.21.10, as well as 4.5.1, specifically targeting the internal island renderer endpoint that handles server-side rendering of components. This flaw exists within the `/__nuxt_island/` path which processes JSON payloads through the destr and ohash libraries before validating URL-resident hashes. The security issue stems from a lack of input validation that allows attackers to submit large JSON bodies without requiring authentication or valid hash verification, leading to resource exhaustion through unnecessary processing.
The technical implementation of this vulnerability demonstrates a classic denial-of-service pattern where the system consumes significant computational resources during request handling without proper input sanitization or rate limiting. The destr library processes attacker-controlled JSON data by fully reading and parsing the entire payload before applying the ohash function to generate a hash for validation, which occurs after all processing is complete. This design flaw creates an opportunity for attackers to exploit the Nitro event loop by submitting large payloads that consume CPU cycles unnecessarily, causing delays in handling concurrent requests and potentially leading to service degradation.
From a cybersecurity perspective, this vulnerability aligns with CWE-400, which classifies resource exhaustion vulnerabilities, and represents a significant concern for web application performance and availability. The issue operates at the application layer where unauthenticated POST requests to `/_nuxt_island/.json` can trigger excessive CPU consumption without proper validation mechanisms. The flaw impacts the Nitro framework's single event loop architecture by creating processing bottlenecks that affect overall system responsiveness and concurrent request handling capacity.
The operational impact of this vulnerability extends beyond simple performance degradation to potentially compromise service availability for legitimate users. Attackers can leverage this weakness through simple HTTP POST requests without requiring any authentication credentials or valid hash values, making the attack surface extremely broad and accessible. The computational overhead from processing large JSON bodies affects not just individual requests but the entire event loop system, creating cascading effects that delay response times for other concurrent operations.
Security mitigations for this vulnerability should focus on implementing proper input validation and rate limiting mechanisms at the framework level. Organizations using affected Nuxt versions should immediately upgrade to patched releases 3.21.10 or 4.5.1 where the issue has been resolved through improved validation of JSON payload size and processing logic. Additionally, network-level protections such as request rate limiting and payload size restrictions can provide defense-in-depth measures while waiting for official patches to be deployed across production environments.
The ATT&CK framework categorizes this vulnerability under T1499.004, which covers resource exhaustion attacks targeting availability, and T1562.001, covering evasion techniques through system resource manipulation. This attack vector demonstrates how seemingly benign application functionality can be exploited to create significant operational impact without requiring advanced technical skills or privileged access. The vulnerability represents a critical flaw in the framework's input handling architecture that affects all applications using affected Nuxt versions and highlights the importance of proper validation of all external inputs regardless of authentication status.
Security practitioners should implement monitoring for unusual patterns in POST request processing to detect potential exploitation attempts, particularly focusing on requests to the `/__nuxt_island/` endpoint with large JSON payloads. The fix implemented in patched versions addresses the root cause by ensuring early validation of input parameters and preventing unnecessary processing of attacker-controlled data before authentication or hash verification occurs. This vulnerability underscores the critical importance of validating all application inputs through proper security controls rather than relying on authentication mechanisms alone, as the attack can succeed without any valid credentials or hash values.
The remediation process requires comprehensive testing of applications to ensure that patched versions maintain expected functionality while addressing the resource exhaustion concerns. Organizations should conduct thorough regression testing to validate that legitimate island rendering functionality continues to operate correctly after applying the patches. The vulnerability demonstrates how framework-level issues can create widespread impact across numerous applications and emphasizes the importance of keeping open-source dependencies updated with security patches to prevent exploitation of known vulnerabilities.