CVE-2026-71321: 
Nuxt Analyse et atténuation des vulnérabilités

CVE-2026-71321 is an unauthenticated CPU exhaustion (Denial of Service) vulnerability in the Nuxt web framework's island renderer endpoint. The flaw affects Nuxt versions >= 3.1.0 and < 3.21.10, and >= 4.0.0 and < 4.5.1. It was disclosed on August 5, 2026 via a GitHub Security Advisory (GHSA-9pgf-384g-p7mv), with patches released on July 27, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is a logic ordering flaw in the /__nuxt_island/... endpoint handler, classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling). When a POST request is received, the handler fully reads, destr-parses, and ohash-hashes the attacker-controlled JSON body before validating the URL-resident hash — meaning all CPU-intensive work is performed on unauthenticated, unvalidated input. Because Nitro operates on a single event loop, a low-rate stream of crafted POST requests to /__nuxt_island/_.json with large JSON bodies (e.g., ~4.6 MB / 150,000 keys) can saturate the event loop and delay or stall all concurrent requests. No authentication or valid hash is required to trigger this condition (GitHub Advisory, Patch Commit v4).

Successful exploitation results in a high-availability impact: the Nitro server's single-threaded event loop becomes saturated, degrading or completely stalling the application for all legitimate users. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service condition. Applications relying on Nuxt's server components or island rendering are most at risk, and even a low request rate is sufficient to cause service disruption (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Nuxt applications running versions >= 3.1.0 and < 3.21.10, or >= 4.0.0 and < 4.5.1, using tools like Shodan or Censys. Look for applications using Nuxt's server components/island rendering feature, which exposes the /__nuxt_island/ endpoint.
2. Craft oversized JSON payload: Construct a large JSON body — for example, an object with ~150,000 keys (~4.6 MB) — designed to maximize CPU time during destr parsing and ohash hashing.
3. Send unauthenticated POST requests: Issue repeated POST /__nuxt_island/_.json requests with the oversized JSON body and no valid hash in the URL. No authentication headers are required.
4. Exhaust the event loop: Because Nitro processes requests on a single event loop, each malicious request forces the server to fully read, parse, and hash the payload before rejecting it with a 400 response. A sustained low-rate stream of such requests saturates the event loop, delaying or stalling all concurrent legitimate requests and effectively causing a Denial of Service (GitHub Advisory).

• Network: Repeated POST requests to /__nuxt_island/_.json or other /__nuxt_island/ paths from one or more source IPs; requests with unusually large Content-Length headers (e.g., > 1 MB) targeting the island endpoint.
• Logs: Server access logs showing high-frequency POST requests to /__nuxt_island/ endpoints returning HTTP 400 responses; elevated request processing times or timeouts for concurrent legitimate requests.
• Process: Sustained high CPU utilization on the Node.js/Nitro process without a corresponding spike in legitimate traffic; event loop lag metrics exceeding normal thresholds.

Upgrade to nuxt@3.21.10 or nuxt@4.5.1, which enforce a raw body-size cap (64 KB, returning HTTP 413) and a JSON nesting-depth cap (64 levels, returning HTTP 400) before any parsing or hashing occurs (Nuxt v3.21.10 Release, Nuxt v4.5.1 Release). As a temporary workaround, configure a small request-body size limit at your reverse proxy or edge layer for requests to /__nuxt_island/ paths, since legitimate island requests only carry compact props payloads. Alternatively, disable server components entirely if they are not in use (GitHub Advisory).

The v3.21.10 and v4.5.1 releases were designated security releases by Nuxt maintainer Daniel Roe, who recommended immediate upgrades. The releases also addressed several other security issues including server-side RCE and route rule authorization bypass, making this a broad security patch batch. A Mastodon post from @thehackerwire noted the advisory shortly after disclosure. No significant independent researcher commentary or media coverage specific to this CVE has been identified beyond standard vulnerability database aggregation (Nuxt v4.5.1 Release, Nuxt v3.21.10 Release).