CVE-2026-71318

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.1.0 through 3.21.9 Nuxt versions 4.0.0 through 4.5.0

Description An issue exists in Nuxt server islands where the / nuxt island/ endpoint accepts props that can be used to drive dynamic component resolution. An attacker can provide a top-level as prop to instantiate any globally-registered Vue component or native HTML element through <component :is>, resolveDynamicComponent, or h(). This occurs because props not explicitly declared by an island fall through as attributes to its root element; if the root is a polymorphic component (such as those in @nuxt/ui or reka-ui), the as value is processed, allowing the injection of elements like <iframe> or registered components like RouterLink.

Recommendations Update Nuxt to version 3.21.10 or 4.5.1. Do not forward island props into <component :is>, resolveDynamicComponent, or h(), and instead use a closed allowlist of imported component definitions. Declare the props an island accepts or set inheritAttrs: false to prevent input from falling through to a polymorphic root component. Avoid registering sensitive components globally to prevent information leakage if they are instantiated by an attacker.