Medium severity4.8NVD Advisory· Published Aug 5, 2026· Updated Sep 8, 2026
CVE-2026-71318
CVE-2026-71318
Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nuxtnpm | >= 4.0.0, < 4.5.1 | 4.5.1 |
nuxtnpm | >= 3.1.0, < 3.21.10 | 3.21.10 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.