The vulnerability occurs when an unauthenticated attacker supplies a specially crafted request that includes a server island v‑for property with an unbounded loop. The server‑side rendering engine allocates memory proportional to MAX_VFOR_LENGTH (up to 100 000 items), causing the Nuxt process to exhaust available RAM and crash. This disruption results in a denial of service against applications using Nuxt, allowing the attacker to temporarily render the site inoperable.

Nuxt applications built with versions 3.1.0 up to but not including 3.21.10 and 4.5.0 are vulnerable. The fix was delivered in Nuxt 3.21.10 and Nuxt 4.5.1. The issue affects the open‑source Nuxt framework for Vue.js, which is used to build server‑rendered web applications.

The CVSS base score of 7.5 classifies this flaw as High, and the lack of reported EPSS data means the current exploit probability is unknown, though the vulnerability allows unauthenticated exploitation. Because the bug is triggered by client input and requires no special privileges, an attacker can readily provoke an out‑of‑memory crash on any public Nuxt deployment. With the vulnerability listed as not in the CISA KEV catalogue, there is no publicly confirmed exploitation yet, but the high impact and ease of triggering warrant immediate action.