Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

GHSA-48HR-524C-V5W3 Nuxt: Unauthorized Component Instantiation via Server Island Props

Impact Nuxt server islands accept props via the /nuxtisland/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution , resolveDynamicComponent, or h, an attacker can pass a plain string value rather than a component definiti...

CVE-2026-71318

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

CVE-2026-71318: Improper Input Validation

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...

Malicious code in chai-as-prop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d21e75438243773776319743f074531328a3b7c3a72438ca9d3fdcc7c2adb74 The package chai-as-prop was found to contain malicious code...

MAL-2026-1670 Malicious code in chai-as-prop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d21e75438243773776319743f074531328a3b7c3a72438ca9d3fdcc7c2adb74 The package chai-as-prop was found to contain malicious code...