Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Impact The internal island renderer endpoint /nuxtisland/... decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /nuxtisland/.json with a large JSON body for example 4.6 MB / 150k keys is fully read, destr-parsed, and run through...

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Impact When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves //payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key no cookie, authorization, or cache.varies...