CVE-2026-71318

Published: Aug 5, 2026Modified: Sep 8, 2026Deferred

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/nuxt/nuxt/releases/tag/v3.21.10

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/releases/tag/v4.5.1

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3

Source: security-advisories@github.com

Timeline

No history available yet.