CyberRota Analysis
AI-GeneratedNuxt versions 3.1.0 to 3.21.10 and 4.5.1 are vulnerable to a denial-of-service attack due to an unbounded server-side rendering (SSR) memory allocation triggered by an unauthenticated attacker exploiting the v-for prop. This vulnerability can lead to the crashing of the Nuxt process, impacting the availability of applications built on this framework. Organizations using affected versions should prioritize patching to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.