CVE-2026-71318: 
Nuxt Analyse et atténuation des vulnérabilités

CVE-2026-71318 is an unauthorized component instantiation vulnerability in the Nuxt web development framework, titled "Nuxt: Unauthorized Component Instantiation via Server Island Props." It affects Nuxt versions >= 3.1.0 and < 3.21.10, as well as >= 4.0.0 and < 4.5.1; Nuxt 2 is not affected. An unauthenticated attacker can supply a top-level as prop to the /__nuxt_island/ endpoint to drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(), instantiating any globally-registered Vue component or native HTML element. The vulnerability was published on July 27, 2026, and patched releases were made available the same day. It carries a CVSS v3.1 base score of 4.8 (Moderate) (GitHub Advisory, Github Advisory).

The root cause is improper input validation (CWE-20) in how Nuxt server islands process incoming props at the /__nuxt_island/ endpoint. When a server island component forwards props into Vue's dynamic component resolution mechanisms (<component :is>, resolveDynamicComponent, or h()), an attacker can pass a plain string value — such as {"as": "SomeGlobalComponent"} or {"as": "iframe"} — to instantiate any globally-registered component or native HTML element. Critically, this does not require vue.runtimeCompiler to be enabled, making it reachable in more configurations than the related RCE vector (GHSA-9473-5f9j-94wq). The implicit attack path arises because undeclared island props fall through as attributes onto the island's single root element; if that root is a polymorphic component (e.g., from @nuxt/ui via reka-ui) that accepts an as prop, the attacker's value reaches the dynamic component sink without any explicit forwarding by the application author (GitHub Advisory).

Successful exploitation allows an attacker to render arbitrary globally-registered Vue components or native HTML elements (such as <iframe>) within a server island response, without user interaction. This can result in limited confidentiality and integrity impacts — for example, leaking information exposed by globally-registered components (e.g., RouterLink rendering attacker-influenced <a> tags with controlled to and other props) or injecting unexpected HTML elements into server-rendered output. Arbitrary JavaScript execution is not possible through this vector, as no template or render compilation occurs; reachable components are constrained to the build-time global registry (GitHub Advisory, Github Advisory).

1. Reconnaissance: Identify a Nuxt application running a vulnerable version (>= 3.1.0 and < 3.21.10, or >= 4.0.0 and < 4.5.1) with server island components active (i.e., .server.vue files present). Look for /__nuxt_island/ endpoints in network traffic or application source.
2. Identify target island: Determine the name of a server island component, typically discoverable via the /__nuxt_island/<ComponentName> URL pattern or by inspecting the application's HTML for island markers.
3. Craft malicious request: Send an HTTP request to the island endpoint with a JSON body or query parameter supplying a top-level as prop, e.g., GET /__nuxt_island/MyIsland?props={"as":"RouterLink","to":"/attacker-path"} or {"as":"iframe"} to inject a native HTML element.
4. Trigger attribute fallthrough: If the island component does not declare its accepted props and its root element is a polymorphic component (e.g., a @nuxt/ui component accepting as), the attacker's as value falls through implicitly to the root, causing it to render as the specified component or element.
5. Observe rendered output: The server island response will include the rendered output of the resolved component (e.g., a RouterLink with attacker-controlled to, or an <iframe> element), potentially leaking information or injecting unexpected markup into the page (GitHub Advisory).

• Network: Unusual or unexpected HTTP requests to /__nuxt_island/<ComponentName> endpoints containing as parameters or JSON props with string values referencing component names (e.g., RouterLink, iframe, or other globally-registered component names).
• Logs: Server access logs showing requests to /__nuxt_island/ with query strings or POST bodies containing "as": keys; after patching, HTTP 400 responses to such requests indicate blocked exploitation attempts.
• Application Output: Server-rendered HTML containing unexpected elements such as <iframe>, <a> tags with attacker-controlled href/to attributes, or unexpected globally-registered component output within island-rendered sections of the page (GitHub Advisory).

Upgrade to nuxt@3.21.10 or nuxt@4.5.1, which reject a top-level as island prop with an HTTP 400 response at the /__nuxt_island/ endpoint, closing the implicit attribute-fallthrough path (Nuxt v3.21.10 Release, Nuxt v4.5.1 Release). For applications that cannot upgrade immediately, the following workarounds apply in any version: (1) Do not forward island props into <component :is>, resolveDynamicComponent, or h(); instead, map untrusted discriminators through a closed allowlist of imported component definitions. (2) Declare all props an island accepts, or set inheritAttrs: false on the island component, to prevent undeclared props from falling through to a polymorphic root. (3) Avoid registering sensitive components globally that could leak information if instantiated by an attacker (GitHub Advisory).

The Nuxt maintainer Daniel Roe published the security advisory and coordinated the patch release on July 27, 2026, describing it as a security release and recommending immediate upgrade via npx nuxt upgrade --dedupe (Nuxt v3.21.10 Release, Nuxt v4.5.1 Release). The release notes also reference a related critical RCE (GHSA-9473-5f9j-94wq) and other security fixes bundled in the same patch releases, indicating a broader security hardening effort for Nuxt server islands. No significant independent researcher commentary or notable media coverage beyond the official advisory has been identified at this time.