high · 7.5CVE-2026-71321Aug 5, 2026

CVE-2026-71321: Nuxt Island Endpoint Unauthenticated CPU Exhaustion (DoS)

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Any anonymous attacker can stall a Nuxt server by sending a large JSON body to the island renderer endpoint, which parses and hashes the input before checking whether the request is even valid.

Packagenuxt
Ecosystemnpm
Affected>= 4.0.0, < 4.5.1
Fixed in4.5.1
CVE-2026-71321: Nuxt Island Endpoint Unauthenticated CPU Exhaustion (DoS)

The problem

The /__nuxt_island/ endpoint in Nuxt 4.x (>=4.0.0) and 3.x (>=3.1.0) read and processed the full request body before validating the URL-resident hash. No authentication is required to reach it.

Because Nitro runs on a single event loop, a destr parse and ohash hash of a multi-megabyte payload blocks every concurrent request. A handful of requests per second is enough to degrade or stall the server entirely.

Proof of concept

A working proof-of-concept for CVE-2026-71321 in nuxt, with the exact payload below.

http
POST /__nuxt_island/MyComponent_deadbeef.json HTTP/1.1
Host: target.example.com
Content-Type: application/json
Content-Length: 4700000

{"k1":1,"k2":2,"k3":3, ... /* ~150 000 unique keys, ~4.6 MB total */ }

The island handler called readBody() (which invokes destr for JSON parsing) and then hash() from ohash on the resulting object before it ever checked whether the hash segment in the URL matched. Both operations are O(n) in the number of keys, and ohash does a deep recursive traversal, making a flat 150k-key object expensive.

The patch in packages/nitro-server/src/runtime/utils/island-props.ts adds two early-exit guards: a raw body-size cap that returns HTTP 413 before any parsing, and a JSON nesting-depth cap of 400 checked with a cheap streaming scan. Oversized or deeply nested input is now rejected before destr or ohash are ever invoked.

CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling) both apply: the work done per request was unbounded and proportional to attacker-controlled input size.

The fix

Upgrade to nuxt@4.5.1 (4.x) or nuxt@3.21.10 (3.x). As a workaround on older versions, configure your reverse proxy or edge to enforce a small body-size limit on all /__nuxt_island/ requests; legitimate island props payloads are compact. You can also disable server components entirely if your app does not use them.

Reported by danielroe.

References: [1][2][3][4][5][6]

Related research