{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/nuxt/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-71314"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nuxt 3","Nuxt 4"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Nuxt"],"content_html":"\u003cp\u003eNuxt versions prior to 4.5.1 and 3.21.10 are vulnerable to a remote denial-of-service attack (CVE-2026-71314). The vulnerability originates in the island/server-component rendering pipeline, where 'v-for' directives can be applied to user-controlled props. Because the island URL hash is a predictable digest, an attacker can craft a request that forces the server-side rendering (SSR) engine to iterate a 'v-for' loop an arbitrary number of times.\u003c/p\u003e\n\u003cp\u003eBy supplying an extremely large integer as the iterated prop, an attacker causes the Nuxt server to allocate memory proportional to the iteration count, leading to an out-of-memory (OOM) crash of the worker process. The vulnerability impacts both direct 'v-for' directives on props and slot-based 'v-for' expansion via the 'vforToArray' utility. Successful exploitation requires only a small (approx. 130-byte) HTTP request. Organizations using Nuxt for SSR should update to the patched versions immediately or implement input clamping for props passed to 'v-for' within server components.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a Nuxt application using server-side rendered islands or components that perform 'v-for' iterations on user-provided props.\u003c/li\u003e\n\u003cli\u003eAttacker inspects public-facing island URL hash generation to understand the request digest format.\u003c/li\u003e\n\u003cli\u003eAttacker constructs a malicious request containing a crafted prop value, specifically a high-integer value intended for a 'v-for' loop.\u003c/li\u003e\n\u003cli\u003eAttacker submits the request to the target endpoint, typically targeting the /__nuxt_island/ path.\u003c/li\u003e\n\u003cli\u003eThe Nuxt SSR engine processes the request and maps the attacker-supplied integer to the 'v-for' iteration logic.\u003c/li\u003e\n\u003cli\u003eThe rendering engine expands the loop during SSR, leading to rapid, unbounded memory allocation within the worker process.\u003c/li\u003e\n\u003cli\u003eThe server process exhausts system memory and crashes, resulting in a denial-of-service for the application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate denial-of-service condition for the targeted application instance. A single small request (approx. 130 bytes) is sufficient to crash a worker process when provided with an iteration count in the tens of millions. This allows for trivial, unauthenticated resource exhaustion and service unavailability across affected infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Nuxt 4.5.1 or 3.21.10 to incorporate the 'MAX_VFOR_LENGTH' clamping logic, which prevents unbounded iteration expansion.\u003c/li\u003e\n\u003cli\u003eAudit application code for components utilizing 'v-for' on props passed from server-side inputs.\u003c/li\u003e\n\u003cli\u003eDeploy manual input validation or clamping in server components using 'Math.min(count, 1000)' to provide defense-in-depth until patching is complete.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for unusual spikes in 500-series status codes targeting the /__nuxt_island/ endpoint, which may indicate crash attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-05T21:25:30Z","date_published":"2026-08-05T21:25:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-dos/","summary":"An unauthenticated remote denial-of-service vulnerability (CVE-2026-71314) in Nuxt allows attackers to trigger memory exhaustion via unbounded 'v-for' iteration within server-side rendered components.","title":"Unauthenticated Denial of Service in Nuxt SSR","url":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-dos/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nuxt (4.4.0, 4.5.0)","nuxt (3.x)","nuxt (4.x)","Nuxt (3.4.0-3.21.9)","Nuxt (4.0.0-4.5.0)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","nuxt","template-injection","cve-2026-71320"],"_cs_type":"advisory","_cs_vendors":["Nuxt"],"content_html":"\u003cp\u003eNuxt versions 4.4.0 through 4.5.0 contain a vulnerability (CVE-2026-71316) where the runtime payload cache incorrectly stores and retrieves data. The vulnerability resides in the \u003ccode\u003ecache:nuxt:payload\u003c/code\u003e storage, which utilizes a path-only cache key, ignoring session-specific context such as cookies, authorization headers, or cache variations. This allows an attacker to access sensitive SSR data by requesting the \u003ccode\u003e/_payload.json\u003c/code\u003e endpoint for routes that have been previously 'warmed' by an authenticated user. The SSR data typically includes results from \u003ccode\u003euseFetch\u003c/code\u003e or \u003ccode\u003euseAsyncData\u003c/code\u003e, which may contain private information like profile details, tenant identifiers, or billing data. The issue is specific to the 4.x release line and was caused by a regression where runtime payload-cache reads and writes were no longer restricted to the prerendering phase.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe target application is configured with \u003ccode\u003erouteRules\u003c/code\u003e using \u003ccode\u003ecache\u003c/code\u003e, \u003ccode\u003eswr\u003c/code\u003e, or \u003ccode\u003eisr\u003c/code\u003e on protected pages that display user-specific data.\u003c/li\u003e\n\u003cli\u003eAn authenticated user accesses a protected, cached route, triggering the server to generate and store the SSR payload in the \u003ccode\u003ecache:nuxt:payload\u003c/code\u003e store.\u003c/li\u003e\n\u003cli\u003eThe cached payload is stored using only the URL path as the key, lacking any session or authorization awareness.\u003c/li\u003e\n\u003cli\u003eAn attacker or an unauthorized user identifies a target path that utilizes Nuxt payload extraction.\u003c/li\u003e\n\u003cli\u003eThe attacker issues a \u003ccode\u003eGET\u003c/code\u003e request to \u003ccode\u003e/\u0026lt;target-path\u0026gt;/_payload.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Nuxt renderer retrieves the stored payload from the shared cache before any route middleware, page guards, or authorization checks are executed.\u003c/li\u003e\n\u003cli\u003eThe sensitive payload, intended only for the original authenticated user, is returned to the unauthorized requester in the response body.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized access to sensitive application data rendered during SSR. This exposure impacts users across different sessions, including the disclosure of profile information, billing details, and internal application data to unauthenticated clients. Any application relying on Nuxt 4.4.0-4.5.0 with caching enabled on authenticated routes is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003enuxt@4.5.1\u003c/code\u003e immediately to restore proper prerendering gates on payload caching.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, set \u003ccode\u003eexperimental.payloadExtraction: false\u003c/code\u003e in the Nuxt configuration to disable the vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eAudit \u003ccode\u003erouteRules\u003c/code\u003e to remove \u003ccode\u003ecache\u003c/code\u003e, \u003ccode\u003eswr\u003c/code\u003e, or \u003ccode\u003eisr\u003c/code\u003e configurations from pages that display user-specific data.\u003c/li\u003e\n\u003cli\u003eImplement authentication requirements at the edge, such as CDN or proxy-level, specifically for \u003ccode\u003e/**/_payload.json\u003c/code\u003e paths as a temporary defense-in-depth measure.\u003c/li\u003e\n\u003cli\u003ePurge CDN and platform caches after applying security updates to ensure potentially leaked payloads are removed from intermediate storage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T03:26:07Z","date_published":"2026-08-05T21:25:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-payload-leak/","summary":"A vulnerability in Nuxt 4.4.0 through 4.5.0 causes sensitive SSR data in the payload cache to be disclosed to unauthorized users due to an insufficient cache key implementation.","title":"Nuxt 4.x Runtime Payload Cache Disclosure","url":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-payload-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Nuxt","version":"https://jsonfeed.org/version/1.1"}