CVE-2026-71318 Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level as prop to the /nuxtisland/ endpoint and drive dynamic component resolution through , resolveDynamicComponent, or h. This issue is fixed in 3.21.10 and 4.5.1...