CVE-2026-71316 in Nuxt
Summary
by MITRE • 08/06/2026
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability affects the Nuxt.js framework version 4.4.0 through 4.5.1, specifically targeting the server-side rendering implementation and cache management system. The flaw involves improper handling of cached payload entries for dynamic routes, where the runtime cache mechanism fails to enforce proper authorization checks before serving sensitive data. When a user requests a specific page endpoint with the _payload.json extension, the framework returns cached content without validating whether the current request should have access to that particular data. This represents a critical information disclosure vulnerability that undermines the security boundaries between different user sessions and their respective SSR data payloads.
The technical root cause stems from the missing enforcement of import.meta.prerender flag during cache retrieval operations. In Nuxt.js applications, this flag typically indicates whether content should be prerendered or dynamically generated for specific routes. When this check is bypassed in the caching layer, it allows unauthorized access to cached payload data that was originally generated for different user contexts or authenticated sessions. The vulnerability specifically impacts routes structured as /<page>/_payload.json where page represents dynamic route segments, enabling attackers to potentially access sensitive server-side rendered content belonging to other users.
The operational impact of this vulnerability extends beyond simple information disclosure, creating potential attack vectors for privilege escalation and data leakage scenarios. An attacker could exploit this weakness to access SSR payloads that contain user-specific data, session information, or application state details that should remain private to specific authenticated contexts. This issue particularly affects applications that implement route middleware or page guards for access control, as the caching mechanism bypasses these security layers entirely. The vulnerability can be leveraged in combination with other reconnaissance techniques to gather comprehensive information about user sessions and application internals.
Security professionals should note this vulnerability aligns with CWE-200 (Information Disclosure) and potentially CWE-352 (Cross-Site Request Forgery) when combined with session manipulation attacks. From an ATT&CK perspective, this represents a technique for privilege escalation and information gathering within the application's server-side execution environment. The fix implemented in version 4.5.1 addresses the core issue by enforcing proper validation of the import.meta.prerender flag during cache retrieval operations, ensuring that cached payloads are only served to authorized users with appropriate access rights. Organizations running affected versions should prioritize immediate upgrade to 4.5.1 or later while implementing additional monitoring for unauthorized access patterns in their application logs.