CVE-2026-71316

Received Received - Intake

Nuxt Framework SSR Data Disclosure via Cache

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-71316

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	to 4.5.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-524	The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuxt affects versions 4.4.0 to 4.5.1. It allows runtime cache entries for /<page>/_payload.json to be accessed before route middleware and page guards. This happens because import.meta.prerender is not enforced, potentially exposing another user's server-side rendered data.

Impact Analysis

An attacker could exploit this to access sensitive server-side rendered data from other users before proper access controls are applied. This may lead to unauthorized disclosure of private information stored in the payload cache.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating privacy principles in GDPR and HIPAA. It may result in non-compliance due to potential breaches of protected health or personal data.

Mitigation Strategies

Upgrade Nuxt to version 4.5.1 or later to address the issue where runtime cache entries disclose user data before middleware and guards.

Hi! I’m here to help you understand CVE-2026-71316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70