CVE-2026-71320

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.4.0 through 3.21.9 Nuxt versions 4.0.0 through 4.5.0

Description An issue exists where an attacker can achieve server-side remote code execution in the Nitro process by injecting a template key through the / nuxt island/ endpoint props into a dynamic component. This occurs when vue.runtimeCompiler: true is enabled and the application utilizes a server island component that forwards props into Vue's dynamic component resolution, such as <component :is>, resolveDynamicComponent, or h(). This can happen explicitly or implicitly via attribute fallthrough if the island's root is a polymorphic component (e.g., components using as or asChild props). Vue's runtime template compiler then compiles and executes the attacker-controlled template in the server process.

Recommendations Update Nuxt to version 3.21.10. Update Nuxt to version 4.5.1. Ensure vue.runtimeCompiler is set to false. Avoid forwarding island props into <component :is>, resolveDynamicComponent, or h() without sanitization. Deploy a WAF rule on the / nuxt island/ endpoint to block any object property named template or render within the decoded island props.