Summary
Nuxt: Unauthorized Component Instantiation via Server Island Props
Mitigating factors
- Exploitation requires a server island component that puts an attacker-controlled value onto a dynamic-component path (
<component :is>,resolveDynamicComponent,h(), or a polymorphicas/asChildprop), either explicitly or via attribute fallthrough when the island's root is such a component. - Reachable components are limited to what is actually in the island app's global registry. In a default pages-enabled app that is
RouterViewandRouterLink(both registered globally by the pages router plugin, which runs even in component islands), plus anycomponents/global/component and any component a module registers globally.RouterLinkin particular renders an attacker-influenced<a>(and, because an island that declares no props forwards all props,toand otherRouterLinkprops ride the same fallthrough). Vue built-ins (Transition,KeepAlive,Teleport,Suspense) and Nuxt auto-imports (ClientOnly,NuxtLink,NuxtPage, etc.) are NOT in the island app's global registry and cannot be resolved this way; an unresolved name instead renders as a native HTML element (the element-injection half of this issue). - Declaring the props an island accepts, or setting
inheritAttrs: falseon it, prevents an undeclaredasfrom falling through to a polymorphic root and neutralizes this vector. - Arbitrary JavaScript execution is not possible through this vector (no
template/rendercompilation). - Island component names are constrained to the build-time component registry; an attacker cannot resolve arbitrary components.
Affected versions
Nuxt >=3.1.0 <3.21.10 and >=4.0.0 <4.5.1, with component islands active. The island prop-forwarding behavior has existed since server islands were introduced in v3.1.0, and this vector does not depend on vue.runtimeCompiler. Nuxt 2 is not affected.
Note the patch (below) closes the implicit attribute-fallthrough path, which is the majority case. An island that explicitly forwards an untrusted prop into dynamic component resolution (or forwards it under a prop name other than as) remains the application's responsibility in every version; see Workarounds.
Workarounds
Upgrade to [email protected] or [email protected]. That upgrade also removes the related object-prop RCE (GHSA-9473-5f9j-94wq). In addition, in any version:
- Do not forward island props into
<component :is>,resolveDynamicComponent, orh(). Map an untrusted discriminator through a closed allowlist of imported component definitions instead of passing the raw prop value. - Declare the props an island accepts, or set
inheritAttrs: falseon it, so request input cannot fall through to a polymorphic root component. - Avoid registering sensitive components globally that could leak information if instantiated by an attacker.
Impact
Nuxt server islands accept props via the /__nuxt_island/ endpoint. When an application has a server island component that forwards props directly into Vue's dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.
For example:
{ "as": "SomeGlobalComponent" }
...resolves and renders SomeGlobalComponent if it is globally registered, even though the attacker should only be able to drive props for the island's declared component. Similarly, { "as": "iframe" } renders an <iframe> element.
Unlike the primary RCE vector (GHSA-9473-5f9j-94wq), this does not require vue.runtimeCompiler to be enabled. A plain string prop is sufficient to trigger component resolution. The template/render key guard that addresses the RCE vector does not block plain string values.
Some component libraries expose a polymorphic as / asChild prop that forwards its value into <component :is>; @nuxt/ui (via reka-ui) is a widely used example. An application is affected if such a component receives the attacker-controlled value inside a server island. Note this does not require explicit prop forwarding: island props the island component does not declare fall through as attributes onto its single root element, so an island whose root is a reka-ui / @nuxt/ui component receives the attacker's as value implicitly. Unlike the RCE vector, no vue.runtimeCompiler is required, which makes this vector reachable in more configurations. These libraries are not themselves vulnerable; they are noted only because they commonly provide the dynamic-component sink. Installing @nuxt/ui does not by itself register any component as a server island: the application must define the island (a .server.vue file).
The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.
CVE-2026-71318 has a CVSS score of 4.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.5.1, 3.21.10); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in [email protected] and [email protected]. Patched releases reject a top-level as island prop (HTTP 400 at the /__nuxt_island/ endpoint). This closes the implicit path: island props an island does not declare fall through as attributes onto its single root, so a top-level as would otherwise reach a polymorphic root component's as prop (the reka-ui / @nuxt/ui convention) and drive dynamic component resolution without the author binding it. Rejecting the top-level as prop blocks that fallthrough while leaving nested data and other prop names untouched.
The framework deliberately does not attempt to block every case: it cannot safely tell a string used as data from one used as a component selector, and it has no island-local hook into Vue's h() or resolveDynamicComponent(). An island that explicitly forwards an untrusted value into <component :is> / h() / resolveDynamicComponent(), or that forwards it under a different polymorphic prop name, is therefore not covered by the patch and must follow the guidance below. The Nuxt documentation now warns against this.
Frequently Asked Questions
- What is CVE-2026-71318? CVE-2026-71318 is a medium-severity improper input validation vulnerability in nuxt (npm), affecting versions >= 4.0.0, < 4.5.1. It is fixed in 4.5.1, 3.21.10. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
- How severe is CVE-2026-71318? CVE-2026-71318 has a CVSS score of 4.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of nuxt are affected by CVE-2026-71318? nuxt (npm) versions >= 4.0.0, < 4.5.1 is affected.
- Is there a fix for CVE-2026-71318? Yes. CVE-2026-71318 is fixed in 4.5.1, 3.21.10. Upgrade to this version or later.
- Is CVE-2026-71318 exploitable, and should I be worried? Whether CVE-2026-71318 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-71318 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-71318?
- Upgrade
nuxtto 4.5.1 or later - Upgrade
nuxtto 3.21.10 or later
- Upgrade