CVE-2026-71316

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.4.0 through 4.5.0

Description When a page is configured with routeRules using cache, swr, or isr, the framework enables runtime payload extraction via the endpoint /<page>/ payload.json. In affected versions, the renderer stores the Server-Side Rendering (SSR) payload in a shared cache:nuxt:payload storage using only the path as a key, ignoring cookies, authorization headers, or cache.varies dimensions. Consequently, the cached entry is returned before route middleware and page guards are executed. This allows an unauthenticated user or a different authenticated user to retrieve the SSR data of the user who first cached the page, potentially disclosing sensitive information loaded via useFetch() or useAsyncData(), such as profiles, tenant details, billing information, or token-like values.

Recommendations Update to version 4.5.1. Set experimental.payloadExtraction to false to disable the standalone / payload.json endpoint. Avoid applying cache, swr, or isr to authenticated pages that render user-specific SSR data. Require authentication for the /**/ payload.json path at a proxy or CDN level. Purge any CDN or platform cache that may contain protected payloads after updating.