Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop,…

A denial-of-service vulnerability exists in Nuxt, an open-source Vue.js web framework, affecting versions 3.1.0 through 3.21.9 and versions prior to 4.5.1. An unauthenticated attacker can exploit the server island v-for prop feature, specifically via vforToArray, to trigger unbounded server-side rendering (SSR) memory allocation. The allocation can grow up to MAX_VFOR_LENGTH of 100,000 entries, ultimately crashing the Nuxt server process. No authentication is required to trigger the vulnerability, making it easily exploitable by remote attackers. The issue has been patched in Nuxt versions 3.21.10 and 4.5.1. Fixes are available via two separate commits on the official Nuxt GitHub repository. Users are strongly advised to upgrade to the patched versions immediately to prevent potential service disruption.