CVE-2026-71316 Details
Description
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.
A vulnerability in Nuxt versions 4.4.0 prior to 4.5.1 allows for unauthorized disclosure of server-side rendered (SSR) data across different users and to unauthenticated clients. This issue arises because the runtime cache for payloads is not properly gated, leading to the leakage of sensitive information such as profile and billing details. The vulnerability is present in the 'cache' and 'isr' route rules, where the payload cache ignores variations based on cookies or authorization headers. As a result, an authenticated user can inadvertently expose their data to others or to unauthenticated requests.
Users can upgrade to Nuxt version 4.5.1, where this vulnerability is fixed. After upgrading, it is recommended to purge any CDN or edge cache that may have cached leaked payloads.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/commit/ac9b41a36b62296a117862254ee7d2b21a2a5203 | [email protected] | Source CodeVendor |
| https://github.com/nuxt/nuxt/releases/tag/v4.5.1 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuxt | >= 4.4.0, <= 4.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |