GHSA-9pgf-384g-p7mv: High severity npm/nuxt vulnerability
Impact
The internal island renderer endpoint (/nuxtisland/...) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /nuxtisland/<name><anything>.json with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, destr-parsed, and run through ohash before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low request rate is enough to degrade or stall the server. No valid hash and no authentication are required.
Patches
Fixed in nuxt@4.5.1 and nuxt@3.21.10. The island handler now enforces a raw body-size cap (413) and a JSON nesting-depth cap (400) before parsing or hashing, so oversized or deeply nested input is rejected cheaply.
Workarounds
Put a small request-body limit in front of /nuxtisland/ at your reverse proxy / edge (islands legitimately send only a compact props payload), or disable server components if unused.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nuxtto a version that resolves this vulnerability.Fixed in 3.21.10 - Upgrade
Upgrade
npm/nuxtto a version that resolves this vulnerability.Fixed in 4.5.1 - Upgrade
Upgrade
nuxtto a version that resolves this vulnerability.Fixed in 4.5.1 - Upgrade
Upgrade
nuxtto a version that resolves this vulnerability.Fixed in 3.21.10 - Configuration
Ensure the island handler enforces a raw body-size limit and rejects oversized requests with HTTP 413 before parsing/hashing.
Nuxt server island endpoint (`/__nuxt_island/...`) enforce raw request body-size cap (reject with 413) = 413 - Configuration
Ensure the island handler enforces a JSON nesting-depth limit and rejects deeply nested input with HTTP 400 before parsing/hashing.
Nuxt server island endpoint (`/__nuxt_island/...`) enforce JSON nesting-depth cap (reject with 400) = 400 - Compensating control
At the reverse proxy/edge, place a small request-body limit in front of the path `/__nuxt_island/` (islands legitimately send only a compact props payload) to mitigate large-body requests that get read/parsed/hashed.