HIGH 7.5 GitHub
CVE-2026-71316
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
### Impact
When a page is covered by `routeRules` `cache` / `swr` / `isr`, Nuxt enables runtime payload extraction and serves `/<page>/_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no cookie, `authorization`, or `cache.varies` dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again.
As a result, once any authenticated user warms a protected,
Affected Products
- npm/nuxt >= 4.4.0, <= 4.5.0
References
- https://github.com/advisories/GHSA-wm8w-6qjm-cv43
- https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43
- https://github.com/nuxt/nuxt/commit/ac9b41a36b62296a117862254ee7d2b21a2a5203
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-05 via GitHub. Affected: npm/nuxt >= 4.4.0, <= 4.5.0.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.