CVE-2026-71316: Nuxt.js Information Disclosure Vulnerability

CVE-2026-71316 Overview

CVE-2026-71316 is an information disclosure vulnerability in Nuxt, an open-source web development framework for Vue.js. Versions from 4.4.0 up to 4.5.1 cache runtime cache:nuxt:payload entries for /<page>/_payload.json routes and return them before route middleware and page guards execute. The framework does not enforce import.meta.prerender at runtime, so cached server-side rendered (SSR) payloads created for one principal can be served to another requester. This allows unauthenticated attackers to obtain another user's SSR data by requesting cached payload endpoints. The issue is fixed in Nuxt 4.5.1 [CWE-524].

Critical Impact
An unauthenticated network attacker can retrieve cached SSR payloads containing another user's data by requesting /<page>/_payload.json before route middleware or page guards evaluate access.

Affected Products

Nuxt 4.4.0 through versions prior to 4.5.1
Applications running Nuxt with the Nitro server runtime payload cache enabled
Vue.js SSR applications using Nuxt page payload endpoints

Discovery Timeline

2026-08-05 - CVE-2026-71316 published to NVD
2026-08-05 - Last updated in NVD database
Fix released - Nuxt 4.5.1 published on GitHub with patch commit ac9b41a36b62296a117862254ee7d2b21a2a5203

Technical Details for CVE-2026-71316

Vulnerability Analysis

Nuxt renders pages on the server and can produce a _payload.json companion file that contains the serialized SSR state for hydration on the client. In vulnerable releases, the Nitro renderer consults a cache:nuxt:payload storage driver keyed by request path before executing route middleware or page guards. When a cached payload exists, the handler returns it directly, bypassing any authorization or per-user context checks. Because the cache key is derived from the URL alone, a payload generated for an authenticated user's session can be served verbatim to a different requester. The result is cross-principal disclosure of any data embedded in the SSR payload, including profile details, entitlements, or business records rendered into the page.

Root Cause

The root cause is a missing environment check on the payload cache lookup. The renderer treats runtime and prerender contexts identically, even though the cache is only safe during static prerendering where no per-request principal exists. The fix confines the cache replay path to prerender mode by gating it on import.meta.prerender, forcing runtime payload requests to fall through to a full render that applies middleware and guards. This is classified as a sensitive information storage in improperly locked cache [CWE-524].

Attack Vector

Exploitation requires no authentication, no privileges, and no user interaction. An attacker sends an HTTP GET to a /<page>/_payload.json URL that another user recently rendered. If the entry is present in the runtime payload cache, the server returns the cached SSR data without evaluating middleware or page guards.

typescript

// Patch: packages/nitro-server/src/runtime/handlers/renderer.ts
    ssrContext.url = url + payloadURL.search

    event._path = event.node.req.url = ssrContext.url
+   // Replay a cached payload only during prerender. At runtime the cache is keyed by path
+   // alone, so serving it would return one principal's SSR data to another and skip route
+   // middleware / page guards; runtime payload requests must fall through to a full render.
    const cacheKey = getPayloadCacheKey(ssrContext.url)
-   if (payloadCache && await payloadCache.hasItem(cacheKey)) {
+   if (import.meta.prerender && payloadCache && await payloadCache.hasItem(cacheKey)) {
      return payloadCache.getItem(cacheKey) as Promise<Partial<RenderResponse>>
    }
  }

Source: GitHub Commit ac9b41a. The patch adds the import.meta.prerender guard so runtime requests skip the cache and re-execute the full render pipeline.

Detection Methods for CVE-2026-71316

Indicators of Compromise

Repeated unauthenticated requests to /<page>/_payload.json endpoints, particularly across different client IPs targeting the same paths.
HTTP 200 responses to _payload.json requests that were expected to require authentication or redirect to a login flow.
Access logs showing _payload.json responses that do not correlate with a preceding page render for the same session.

Detection Strategies

Inventory Nuxt applications and identify versions between 4.4.0 and 4.5.0 inclusive by inspecting package.json and lockfiles.
Compare responses from /<page>/_payload.json against authenticated page renders to detect cross-principal data returned without session context.
Correlate reverse proxy or CDN logs to flag _payload.json responses served without a matching authenticated user session.

Monitoring Recommendations

Alert on anomalous request volume to _payload.json endpoints across authenticated routes.
Log and review Nitro cache hits for the cache:nuxt:payload namespace when the runtime is not in prerender mode.
Monitor egress payload sizes on _payload.json responses to catch bulk enumeration of cached pages.

How to Mitigate CVE-2026-71316

Immediate Actions Required

Upgrade Nuxt to version 4.5.1 or later in all production and staging environments.
Purge or invalidate any existing cache:nuxt:payload storage that was populated by a vulnerable release.
Audit access logs for _payload.json requests since the upgrade to 4.4.0 to identify potential exposure.

Patch Information

The fix is delivered in Nuxt v4.5.1 via commit ac9b41a. The patch gates the payload cache replay on import.meta.prerender, ensuring runtime requests always fall through to a full render that applies middleware and page guards. Additional context is available in GitHub Security Advisory GHSA-wm8w-6qjm-cv43.

Workarounds

Disable the runtime cache:nuxt:payload storage driver in the Nitro configuration until the upgrade is applied.
Block or rewrite public requests to /<page>/_payload.json at the reverse proxy or CDN for routes protected by authentication.
Ensure route middleware executes before any custom caching layer for SSR payloads on protected pages.

bash

# nuxt.config example: remove or override the runtime payload cache storage
# Update Nuxt to the patched release
npm install nuxt@4.5.1

# Optional: block payload endpoints at the edge (nginx)
# location ~* /_payload\.json$ {
#     return 404;
# }