CVE-2026-71321

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.1.0 through 3.21.9 Nuxt versions 4.0.0 through 4.5.0

Description The internal island renderer endpoint / nuxt island/... decodes and hashes attacker-controlled JSON body input using destr and ohash before validating the URL-resident hash. An unauthenticated POST / nuxt island/ .json request containing a large JSON body is fully read, parsed, and hashed before being rejected. Since Nitro operates on a single event loop, this process consumes excessive CPU resources and delays concurrent requests, allowing a low request rate to degrade or stall the server. No authentication or valid hash is required to trigger this behavior.

Recommendations Update to version 3.21.10. Update to version 4.5.1. Implement a small request-body limit for the / nuxt island/ endpoint at the reverse proxy or edge level. Disable server components if they are not being used.