By supplying an extremely large integer as the iterated prop, an attacker causes the Nuxt server to allocate memory proportional to the iteration count, leading to an out-of-memory (OOM) crash of the worker process. The vulnerability impacts both direct 'v-for' directives on props and slot-based 'v-for' expansion via the 'vforToArray' utility. Successful exploitation requires only a small (approx. 130-byte) HTTP request. Organizations using Nuxt for SSR should update to the patched versions immediately or implement input clamping for props passed to 'v-for' within server components.

Attack Chain

1. Attacker identifies a Nuxt application using server-side rendered islands or components that perform 'v-for' iterations on user-provided props.
2. Attacker inspects public-facing island URL hash generation to understand the request digest format.
3. Attacker constructs a malicious request containing a crafted prop value, specifically a high-integer value intended for a 'v-for' loop.
4. Attacker submits the request to the target endpoint, typically targeting the /__nuxt_island/ path.
5. The Nuxt SSR engine processes the request and maps the attacker-supplied integer to the 'v-for' iteration logic.
6. The rendering engine expands the loop during SSR, leading to rapid, unbounded memory allocation within the worker process.
7. The server process exhausts system memory and crashes, resulting in a denial-of-service for the application.

Impact

Successful exploitation results in an immediate denial-of-service condition for the targeted application instance. A single small request (approx. 130 bytes) is sufficient to crash a worker process when provided with an iteration count in the tens of millions. This allows for trivial, unauthenticated resource exhaustion and service unavailability across affected infrastructure.

Recommendation

• Update to Nuxt 4.5.1 or 3.21.10 to incorporate the 'MAX_VFOR_LENGTH' clamping logic, which prevents unbounded iteration expansion.
• Audit application code for components utilizing 'v-for' on props passed from server-side inputs.
• Deploy manual input validation or clamping in server components using 'Math.min(count, 1000)' to provide defense-in-depth until patching is complete.
• Monitor webserver logs for unusual spikes in 500-series status codes targeting the /__nuxt_island/ endpoint, which may indicate crash attempts.