Summary
CVE-2026-71316 is a sensitive-information cache disclosure and missing-authorization vulnerability in the Nuxt web framework. Nuxt’s runtime payload cache returns cached server-side rendered (SSR) payloads before route middleware and page guards execute, allowing unauthenticated network clients to receive SSR data cached for other users. It affects Nuxt 4.4.0 through 4.5.0 and carries a CVSS v3.1 base score of 7.5 (High).
Technical details
- Root cause: The renderer stored SSR payloads in shared cache storage keyed only on the page path, omitting authentication dimensions such as cookies or authorization headers. Route middleware and page guards ran after the cached entry was returned rather than before, due to unenforced
import.meta.prerenderchecks (CWE-524: Use of Cache Containing Sensitive Information; CWE-862: Missing Authorization). - Trigger conditions: An authenticated user accesses a protected page whose SSR payload is then cached.
- Attack vector: Network. A different user or unauthenticated client requests the cached payload endpoint (
/<page>/_payload.json) and receives the first user’s cached SSR data. No privileges, authentication, or user interaction are required. - Impact: Unauthorized disclosure of another user’s server-side rendered data, potentially including API responses, profile data, and other sensitive information. Confidentiality impact is high; integrity and availability are not affected.
Affected software
- Nuxt 4.4.0 through 4.5.0 (inclusive)
- Nuxt 3.x and 5.x are not affected (they retained the
import.meta.prerendergates)
Severity
- CVSS v3.1 base score: 7.5 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Upgrade to Nuxt 4.5.1, which contains the fix.
- If no patch can be applied:
- Disable payload extraction by setting
experimental.payloadExtraction: false. - Avoid caching authenticated pages that contain user-specific SSR data.
- Restrict access to
/**/_payload.jsonat the CDN or reverse-proxy layer. - Purge any existing cached payloads from CDN infrastructure.
- Disable payload extraction by setting
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
<div id="__nuxt",window.__NUXT__ - URL of a loaded script:
/_nuxt/ - JavaScript object present once the page runs:
$nuxt

