Unrated severityNVD Advisory· Published Aug 5, 2026
Nuxt: Unauthorized Component Instantiation via Server Island Props
CVE-2026-71318
Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
Affected products
1Patches
Vulnerability mechanics
References
3- github.com/nuxt/nuxt/releases/tag/v3.21.10mitrex_refsource_MISC
- github.com/nuxt/nuxt/releases/tag/v4.5.1mitrex_refsource_MISC
- github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.