https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 10 Aug 2026 16:49:58 +0000 https://vulnerability.circl.lu/sighting/7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0/export {"uuid": "7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://gist.github.com/alon710/9e89754682c03d2a6b1ce15876ecc693", "content": "# CVE-2026-71321: CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71321\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.\n\n## TL;DR\nUnauthenticated POST requests with massive or deeply nested JSON to Nuxt's internal island endpoint block the single-threaded Node.js event loop, causing a complete denial of service before verifying cryptographic signatures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 / CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- Nuxt Framework versions 3.x prior to 3.21.10\n- Nuxt Framework versions 4.x prior to 4.5.1\n- **nuxt**: >= 3.1.0, < 3.21.10 (Fixed in: `3.21.10`)\n- **nuxt**: >= 4.0.0, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade Nuxt to version 3.21.10, 4.5.1, or higher.\n- Implement request body size limits at the reverse proxy or WAF layer specifically for the island endpoint path.\n- Deploy rate limiting on Nuxt island rendering paths to mitigate rapid-fire POST attacks.\n\n**Remediation Steps:**\n1. Identify any deployed applications running vulnerable versions of Nuxt (3.1.0 to 3.21.9, or 4.0.0 to 4.5.0).\n2. Update the dependency configuration in package.json to reference a secure version (e.g., ^3.21.10 or ^4.5.1).\n3. Run the corresponding package manager install command (e.g., npm install, yarn install, or pnpm install) to apply the update.\n4. Validate the deployed environment behavior by verifying that payloads over 64KB on the island endpoint return an HTTP 413 error status code.\n\n## References\n\n- [Nuxt Security Advisory (Primary source)](https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv)\n- [Core Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e)\n- [Secondary Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22)\n- [Nuxt v3.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v3.21.10)\n- [Nuxt v4.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v4.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71321) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T00:31:22.953671Z"} {"uuid": "7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://gist.github.com/alon710/9e89754682c03d2a6b1ce15876ecc693", "content": "# CVE-2026-71321: CVE-2026-71321: Unauthenticated Denial of Service and CPU Exhaustion in Nuxt Island Renderer\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71321\n\n## Summary\nAn unauthenticated remote denial of service vulnerability exists in the Nuxt framework island renderer endpoint. By transmitting large or deeply nested JSON payloads, an attacker can block the single-threaded Node.js event loop, resulting in application-wide CPU exhaustion before signature verification occurs.\n\n## TL;DR\nUnauthenticated POST requests with massive or deeply nested JSON to Nuxt's internal island endpoint block the single-threaded Node.js event loop, causing a complete denial of service before verifying cryptographic signatures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 / CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- Nuxt Framework versions 3.x prior to 3.21.10\n- Nuxt Framework versions 4.x prior to 4.5.1\n- **nuxt**: >= 3.1.0, < 3.21.10 (Fixed in: `3.21.10`)\n- **nuxt**: >= 4.0.0, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade Nuxt to version 3.21.10, 4.5.1, or higher.\n- Implement request body size limits at the reverse proxy or WAF layer specifically for the island endpoint path.\n- Deploy rate limiting on Nuxt island rendering paths to mitigate rapid-fire POST attacks.\n\n**Remediation Steps:**\n1. Identify any deployed applications running vulnerable versions of Nuxt (3.1.0 to 3.21.9, or 4.0.0 to 4.5.0).\n2. Update the dependency configuration in package.json to reference a secure version (e.g., ^3.21.10 or ^4.5.1).\n3. Run the corresponding package manager install command (e.g., npm install, yarn install, or pnpm install) to apply the update.\n4. Validate the deployed environment behavior by verifying that payloads over 64KB on the island endpoint return an HTTP 413 error status code.\n\n## References\n\n- [Nuxt Security Advisory (Primary source)](https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv)\n- [Core Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e)\n- [Secondary Fix Commit (Nitro Island Handler)](https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22)\n- [Nuxt v3.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v3.21.10)\n- [Nuxt v4.x Patched Release Notes](https://github.com/nuxt/nuxt/releases/tag/v4.5.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71321) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T00:31:22.953671Z"} https://vulnerability.circl.lu/sighting/7ca4683d-b27a-42b5-a2c1-dd6dffbdd3a0/export Thu, 06 Aug 2026 00:31:22 +0000 https://vulnerability.circl.lu/sighting/261cf48e-db64-4430-8d87-0c6687cb42ad/export {"uuid": "261cf48e-db64-4430-8d87-0c6687cb42ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mserrc4jjo2x", "content": "Nuxt Bleeds Out Again While Bureaucrats Admire the Alarm Light\nPANIC 72% | Lag 0.0h | CVE-2026-71321 is a high-severity vulnerability affecting Nuxt versions from 3.1.0 through 3.21.10 a\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-06T00:25:58.579318Z"} {"uuid": "261cf48e-db64-4430-8d87-0c6687cb42ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mserrc4jjo2x", "content": "Nuxt Bleeds Out Again While Bureaucrats Admire the Alarm Light\nPANIC 72% | Lag 0.0h | CVE-2026-71321 is a high-severity vulnerability affecting Nuxt versions from 3.1.0 through 3.21.10 a\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-08-06T00:25:58.579318Z"} https://vulnerability.circl.lu/sighting/261cf48e-db64-4430-8d87-0c6687cb42ad/export Thu, 06 Aug 2026 00:25:58 +0000 https://vulnerability.circl.lu/sighting/f6b8bcfb-f12d-4cc4-8fc2-ee626f40cdc3/export {"uuid": "f6b8bcfb-f12d-4cc4-8fc2-ee626f40cdc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msemzxn76q2b", "content": "\ud83d\udfe0 CVE-2026-71321 - High (7.5)\n\nNuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71321/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T23:01:20.804545Z"} {"uuid": "f6b8bcfb-f12d-4cc4-8fc2-ee626f40cdc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71321", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msemzxn76q2b", "content": "\ud83d\udfe0 CVE-2026-71321 - High (7.5)\n\nNuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71321/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T23:01:20.804545Z"} https://vulnerability.circl.lu/sighting/f6b8bcfb-f12d-4cc4-8fc2-ee626f40cdc3/export Wed, 05 Aug 2026 23:01:20 +0000