CVE-2026-128074: Nuxt payload URL generation has quadratic cost for repeated slashes in the request path
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, payload.json URL generation and the experimental early-404 path use a trailing-slash regular expression whose work grows quadratically with a long run of slash characters. An unauthenticated request can synchronously occupy the Node.js event loop and delay other requests when server-side rendering uses isr, swr, or cache route rules, or when experimental.early404 is enabled. Applications without those route rules and without experimental.early404, fully prerendered applications, and client-only applications are unaffected; the impact is limited to availability. This issue is fixed in version 4.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.4
Event History
Frequently Asked Questions
Which Nuxt deployments are exposed to this issue?
Affected deployments use Nuxt versions from 4.6.0 through 4.6.4 and perform server-side rendering with isr, swr, or cache route rules, or have experimental.early404 enabled. Fully prerendered and client-only applications, as well as applications without those route rules and without experimental.early404, are unaffected.
What does an attacker need to exploit it?
An attacker only needs to send an unauthenticated request with a request path containing a long run of slash characters. The vulnerable URL-generation path can then synchronously occupy the Node.js event loop.
What is the practical impact?
The impact is limited to availability. Event-loop blocking can delay other requests while the crafted request is processed.
How can this be remediated?
Update Nuxt to version 4.6.4, which fixes the issue. If upgrading cannot happen immediately, disabling the affected SSR route rules and experimental.early404 avoids the described vulnerable code paths.