Nuxt, the open‑source Vue.js framework, contains a flaw in its internal island renderer endpoint that processes attacker‑controlled JSON bodies before validating a URL‑resident hash. An unauthenticated POST request to /__nuxt_island/_.json with a large payload causes the server to fully parse, hash, and then reject, consuming significant CPU time and resulting in a denial‑of‑service condition. This weakness arises from improper validation ordering (CWE‑407). The flaw can be triggered without authentication or a valid hash, allowing an attacker to exhaust server resources.

The affected product is the Nuxt framework. Vulnerable releases include version 3.x from 3.1.0 through 3.21.10 inclusive, and the 4.5.1 release. These updates contain the fix.

The CVSS score of 7.5 indicates high severity. Although the EPSS score is not available, the vulnerability can be exploited remotely from any Internet‑accessible instance because no authentication is required. Because the Nitro single‑event‑loop design amplifies CPU usage, an attacker can deliberately send large JSON bodies to degrade performance or deny legitimate traffic. The issue is not listed in CISA KEV, but its impact makes patching a high priority.