CVSS 3.1
4.8 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2026-71318
Medium (4.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in nuxt 3.21.10, 4.5.1.
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-48hr-524c-v5w3 | npm | nuxt | >=4.0.0 <4.5.1 | 4.5.1 |
| GHSA-48hr-524c-v5w3 | npm | nuxt | >=3.1.0 <3.21.10 | 3.21.10 |