{"action":"Upgrade nuxt to 3.21.10 or later.","affected":[{"fixed":"4.5.1","introduced":"4.0.0"},{"fixed":"3.21.10","introduced":"3.1.0"}],"component":"nuxt","cve_ids":["CVE-2026-71321"],"ecosystem":"npm","epss":0.00742,"exploited":false,"fixed_versions":["4.5.1","3.21.10"],"ghsa_id":"GHSA-9pgf-384g-p7mv","id":"tcs_01M5KFGFY2G5JREMDX9D46PDY0","modified_at":"2026-08-05T21:55:59.649282Z","published_at":"2026-08-05T21:43:03Z","references":["https://osv.dev/vulnerability/GHSA-9pgf-384g-p7mv","https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv","https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e","https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22","https://github.com/nuxt/nuxt","https://github.com/nuxt/nuxt/releases/tag/v3.21.10","https://github.com/nuxt/nuxt/releases/tag/v4.5.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9pgf-384g-p7mv","url":"https://osv.dev/vulnerability/GHSA-9pgf-384g-p7mv"}],"summary":"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation"}