CVE-2026-71314

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.1.0 through 3.21.9 Nuxt versions 4.0.0 through 4.5.0

Description An unauthenticated attacker can cause a Nuxt server to crash by triggering unbounded Server-Side Rendering (SSR) memory allocation. This occurs when a server island or server component renders a v-for loop over a prop, such as v-for="n in count" or a <slot v-for>. By computing a valid hash for arbitrary props and sending a large integer as the iterated prop, the attacker forces the server to expand the loop into a massive number of nodes, allocating memory proportional to the provided value. This affects both the standard Vue ssrRenderList path and the vforToArray slot-props helper. For example, a request with count=40000000 can lead to an out-of-memory crash of the worker process.

Recommendations Update Nuxt to version 3.21.10. Update Nuxt to version 4.5.1. As a temporary workaround, avoid using v-for directly over unclamped props in server components or manually clamp the count within the component using Math.min().