Improper Validation of Specified Quantity in Input

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the v-for in server-side rendering of islands or server components. An attacker can cause the server to allocate excessive...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +79 more potentially affected by CVE-2026-71314 via nuxt (>=3.1.2, <=3.21.8)

nuxt NPM version =3.1.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-71314 Source advisory: OSV:GHSA-HXCR-HM88-MPQ6...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +22 more potentially affected by CVE-2026-71314 via nuxt (>=4.0.0-rc.0, <=4.5.0)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =1.6.0-rc.3, =0.4.5, =0.0.0, =1.1.0, =2.0.1 - @uxfront/layer-app 0.1.0 - @zach-mac/zachscommoncomponents 1.0.4 and more Source cves: CVE-2026-71314 Source advisory: SNYK:JS-NUXT-18565122...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the v-for in server-side rendering of islands or server components. An attacker can cause the server to allocate excessive memory and crash by sending a request with a large integer...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +18 more potentially affected by CVE-2026-71314 via @nuxt/nitro-server (>=4.2.0, <=4.5.0)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =1.6.0-rc.3, =0.4.5, =3.0.0-dev.27, =1.0.0, =4.2.0, =0.5.0, =0.6.0 and more Source cves: CVE-2026-71314 Source advisory: SNYK:JS-NUXTNITROSERVER-18565123...

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Impact An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop for example v-for="n in count" or a . Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props a...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +79 more potentially affected by CVE-2026-71314 via nuxt (>=3.1.2, <=3.21.8)

nuxt NPM version =3.1.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-71314 Source advisory: SNYK:JS-NUXT-18565122...

CVE-2026-71314

Nuxt (Vue.js framework) is affected by CVE-2026-71314 in versions 3.1.0 through 3.21.10 and 4.5.1. An unauthenticated attacker can trigger unbounded server-side rendering memory growth via a server island v-for prop (including vforToArray and related usage), leading to memory exhaustion and a Nux...

EUVD-2026-53644

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...

MAL-2026-6934 Malicious code in load-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e95bb337136d6bfafcd6f21bb8cb1d98da703f7e20b851b3af82876018ffac Package name resembles the Nuxt ecosystem's helper naming 'load-nuxt' and is published at version 99.0.3, a version-number shape frequently used in...

Malicious code in load-nuxt-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0f879297070c07197ace88cfb411c61d497ad150e39c2c5c91349737f5d83a The package name resembles the legitimate Nuxt ecosystem tooling e.g., @nuxt/load-nuxt, and the version 99.0.3 is a common dependency-confusion /...

Malicious code in nuxt-fonts-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...

Malicious code in load-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e95bb337136d6bfafcd6f21bb8cb1d98da703f7e20b851b3af82876018ffac Package name resembles the Nuxt ecosystem's helper naming 'load-nuxt' and is published at version 99.0.3, a version-number shape frequently used in...

MAL-2026-6937 Malicious code in nuxt-fonts-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...

MAL-2026-6935 Malicious code in load-nuxt-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0f879297070c07197ace88cfb411c61d497ad150e39c2c5c91349737f5d83a The package name resembles the legitimate Nuxt ecosystem tooling e.g., @nuxt/load-nuxt, and the version 99.0.3 is a common dependency-confusion /...

@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.0-rc.5) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)

@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...

@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.0-rc.5) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)

@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59194 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59194 Source advisory: OSV:GHSA-72R4-9C5J-MJ57...