CVE-2026-71321 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
Unauthenticated attackers can cause CPU exhaustion and service delays by sending large JSON payloads to the Nuxt island endpoint before hash validation occurs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71321?
CVE-2026-71321 is a high-severity denial of service vulnerability in nuxt, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
Which versions are affected by CVE-2026-71321?
4 open source packages ship an affected version, including nuxt.
| Package | Affected | Fixed in |
|---|---|---|
nuxt npm | From 3.1.0 | 3.21.10 |
nuxt npm | From 3.1.0 | 3.21.10 |
nuxt npm | From 4.0.0 | 4.5.1 |
nuxt npm | From 4.0.0 | 4.5.1 |
How do I fix CVE-2026-71321?
Upgrade nuxt to a fixed version for your release line: 3.21.10 or 4.5.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-71321 being exploited?
There is no known exploitation of CVE-2026-71321 in the wild and no public exploit code.
Sources
Also known as GHSA-9pgf-384g-p7mv.