CVE-2026-71314
- Source
- https://cve.org/CVERecord?id=CVE-2026-71314
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71314.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71314
- Aliases
- Downstream
- Published
- 2026-08-05T20:58:50Z
- Modified
- 2026-10-28T02:30:46Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Details
-
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1284", "CWE-400", "CWE-770", "CWE-789" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71314.json" }- References
-
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71314.json
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-71314
- https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e
- https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22
Affected packages
Git / github.com/nuxt/nuxt
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nuxt/nuxt
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "4.0.0" }, { "fixed": "4.5.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "3.1.0" }, { "fixed": "3.21.10" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "4e35ae9babd94be53246e31200232d48438bb34e" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "668cdfdfda41849ed11c1ee5e2067a11fc103b22" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v3.21.10", "range": [ { "fixed": "deafc94128005346ed8ef4dd5e64f940d80377d3" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v4.5.1", "range": [ { "fixed": "452dd50d92ccdf6f456b500e71d0f26baaeff796" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
3.*
3.1.1
v3.*
v3.1.0
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.159
v3.14.1592
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.17.6
v3.17.7
v3.18.0
v3.18.1
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.20.0
v3.20.1
v3.20.2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.21.7
v3.21.8
v3.21.9
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.4.8
v4.5.0