Description
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nuxt nuxt
>= 4.0.0, < 4.5.1affected>= 3.1.0, < 3.21.10affected
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6 ↗
- https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e ↗
- https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22 ↗
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10 ↗
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1 ↗