{"id":"CVE-2026-71314","aliases":["CLSA-2026-1788450984","CLSA-2026-1789598338","CLSA-2026-1792161460","CLSA-2026-1792161463","CLSA-2026-1792161485","CLSA-2026-1792161601","CLSA-2026-1792161604","CLSA-2026-1792161823","CLSA-2026-1792161826","CLSA-2026-1792161936","CLSA-2026-1792161939","CLSA-2026-1793661077","EUVD-2026-53644","GHSA-hxcr-hm88-mpq6"],"status":"published","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00908,"percentile":0.60405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284","CWE-400","CWE-770","CWE-789"],"published":"2026-08-05T20:58:50Z","modified":"2026-11-03T02:45:02Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.5.1","3.21.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nuxi","fixed_in":["3.2.0-tuxcare.10"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.2","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5","4.0.3-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.7"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3","4.0.3-tuxcare.4","4.0.3-tuxcare.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.10"}]}],"versions":["3.2.0","3.2.0-tuxcare.2","3.2.0-tuxcare.4","3.2.0-tuxcare.5","3.2.0-tuxcare.6","3.2.0-tuxcare.7","3.2.0-tuxcare.8","3.2.0-tuxcare.9"]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.1.0"},{"fixed":"3.21.10"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.10","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-hxcr-hm88-mpq6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71314.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71314","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-71314","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T20:58:50.965Z","modified":"2026-08-06T13:33:38.81Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770","CWE-789","CWE-1284"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53644","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T20:58:50Z","modified":"2026-08-06T13:33:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-hxcr-hm88-mpq6","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","description":"### Impact\n\nAn unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a `v-for` over a prop (for example `v-for=\"n in count\"` or a `\u003cslot v-for\u003e`). Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props and send the iterated prop as a large integer. The server then expands the `v-for` to that many nodes during SSR, allocating memory proportional to the attacker's number. Reporter figures: `count=8000000` produced a 142.9 MB response; `count=40000000` (and `items=4000000` on a slot list) produced an out-of-memory crash of the worker from a single ~130-byte request. Both the plain `v-for` path (Vue's `ssrRenderList`) and the slot path (`vforToArray`) are affected.\n\n### Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. Island/server-component `v-for` sources are now clamped to a maximum iteration count (`MAX_VFOR_LENGTH = 100000`) at the render boundary, covering the plain path, the `\u003cslot v-for\u003e` element, and the `vforToArray` slot-props helper. Combined with the body-size cap (GHSA-9pgf-384g-p7mv), a single island render can no longer allocate without bound regardless of which `v-for` path is used or whether the prop arrives as an integer or an array.\n\n### Workarounds\n\nAvoid `v-for` directly over an unclamped prop in server components, or clamp the count in the component (`v-for=\"n in Math.min(count, 1000)\"`). A body-size limit in front of `/__nuxt_island/` only mitigates array-shaped inputs, not the integer-amplification case.\n\n### References\n\n- Bound helper: `packages/nuxt/src/app/components/vfor.ts`\n- Transform: `packages/nuxt/src/components/plugins/islands-transform.ts`\n- Slot helper: `packages/nuxt/src/app/components/utils.ts` (`vforToArray`)","status":"published","published":"2026-08-05T20:59:04Z","modified":"2026-08-05T20:59:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770","CWE-789","CWE-1284"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-71314","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T21:16:59.15Z","modified":"2026-09-08T20:51:43.49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770","CWE-789","CWE-1284"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71314","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","description":"Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.","status":"published","published":"2026-08-05T20:58:50.965Z","modified":"2026-10-28T02:30:46.394173638Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-400","CWE-770","CWE-789"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"GHSA-hxcr-hm88-mpq6","title":"Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering","description":"### Impact\n\nAn unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a `v-for` over a prop (for example `v-for=\"n in count\"` or a `\u003cslot v-for\u003e`). Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props and send the iterated prop as a large integer. The server then expands the `v-for` to that many nodes during SSR, allocating memory proportional to the attacker's number. Reporter figures: `count=8000000` produced a 142.9 MB response; `count=40000000` (and `items=4000000` on a slot list) produced an out-of-memory crash of the worker from a single ~130-byte request. Both the plain `v-for` path (Vue's `ssrRenderList`) and the slot path (`vforToArray`) are affected.\n\n### Patches\n\nFixed in `nuxt@4.5.1` and `nuxt@3.21.10`. Island/server-component `v-for` sources are now clamped to a maximum iteration count (`MAX_VFOR_LENGTH = 100000`) at the render boundary, covering the plain path, the `\u003cslot v-for\u003e` element, and the `vforToArray` slot-props helper. Combined with the body-size cap (GHSA-9pgf-384g-p7mv), a single island render can no longer allocate without bound regardless of which `v-for` path is used or whether the prop arrives as an integer or an array.\n\n### Workarounds\n\nAvoid `v-for` directly over an unclamped prop in server components, or clamp the count in the component (`v-for=\"n in Math.min(count, 1000)\"`). A body-size limit in front of `/__nuxt_island/` only mitigates array-shaped inputs, not the integer-amplification case.\n\n### References\n\n- Bound helper: `packages/nuxt/src/app/components/vfor.ts`\n- Transform: `packages/nuxt/src/components/plugins/islands-transform.ts`\n- Slot helper: `packages/nuxt/src/app/components/utils.ts` (`vforToArray`)","status":"published","published":"2026-08-05T20:59:04Z","modified":"2026-08-05T21:25:59.80116Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284","CWE-400","CWE-770","CWE-789"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"CLSA-2026-1788450984","title":"TuxCare security update for nuxt (11 CVEs)","description":"TuxCare rebuilt nuxt to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-09-03T15:56:24Z","modified":"2026-10-15T09:48:03.152914241Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789598338","title":"TuxCare security update for nuxt (7 CVEs)","description":"TuxCare rebuilt nuxt to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-09-16T22:38:58Z","modified":"2026-10-15T09:47:56.237986037Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792161460","title":"TuxCare security update for @nuxt/kit (11 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:37:40Z","modified":"2026-10-16T16:31:03.072757342Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161463","title":"TuxCare security update for @nuxt/kit (7 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:37:43Z","modified":"2026-10-16T16:30:58.380403359Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161485","title":"TuxCare security update for @nuxt/rspack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:38:05Z","modified":"2026-10-16T16:30:59.69839942Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161601","title":"TuxCare security update for @nuxt/schema (11 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:40:01Z","modified":"2026-10-16T16:31:05.866570588Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161604","title":"TuxCare security update for @nuxt/schema (7 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:40:04Z","modified":"2026-10-16T16:31:05.873102631Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161823","title":"TuxCare security update for @nuxt/vite-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:43:43Z","modified":"2026-10-16T16:30:34.584872899Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161826","title":"TuxCare security update for @nuxt/vite-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:43:46Z","modified":"2026-10-16T16:30:32.87761218Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161936","title":"TuxCare security update for @nuxt/webpack-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:45:36Z","modified":"2026-10-16T16:31:30.28168697Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161939","title":"TuxCare security update for @nuxt/webpack-builder (7 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 7 CVEs. Fixed in 4.0.3-tuxcare.7.","status":"published","published":"2026-10-16T14:45:39Z","modified":"2026-10-16T16:31:19.053836641Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1793661077","title":"TuxCare security update for nuxi (1 CVE)","description":"TuxCare rebuilt nuxi to address 1 CVE. Fixed in 3.2.0-tuxcare.10.","status":"published","published":"2026-11-03T00:11:16Z","modified":"2026-11-03T02:45:02.370192274Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}