Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.
Severity (CVSS)
| Base score | 7.5 |
|---|---|
| Severity | High |
| Version | CVSS 3.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Provided by | CNA |
Weaknesses
- CWE-400 — CWE-400: Uncontrolled Resource Consumption
- CWE-770 — CWE-770: Allocation of Resources Without Limits or Throttling
- CWE-789 — CWE-789: Memory Allocation with Excessive Size Value
- CWE-1284 — CWE-1284: Improper Validation of Specified Quantity in Input
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nuxt | nuxt | >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 |
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6 (x_refsource_CONFIRM)
- https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e (x_refsource_MISC)
- https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22 (x_refsource_MISC)
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10 (x_refsource_MISC)
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1 (x_refsource_MISC)
Generated from the official CVE List on 06 Aug 2026 07:06 UTC.