CVE-2026-71318 MEDIUM

CVE-2026-71318: Nuxt: Unauthorized Component Instantiation via Server Island Props

Vendor Nuxt
Product nuxt
Weakness CWE-20 · Input validation
Published August 5, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.

Key dates

02Disclosure timeline

August 5, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-36505 WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion CVE-2025-12718 Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay CVE-2024-5533 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-2165 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2026-3460 REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter