Executive brief
Nuxt, a popular web development framework, contains a vulnerability where sensitive user data can be accidentally shared with other users or unauthorized visitors. When certain caching features are enabled, the system may store a user's private information (like profile details or billing data) and serve it to the next person who visits the same page. This could lead to significant data leaks and privacy violations for applications handling personal user information.
Technical details
A vulnerability in Nuxt 4.x (v4.4.0 to v4.5.0) occurs when runtime payload extraction is enabled via routeRules (cache, swr, or isr). The renderer stores Server-Side Rendering (SSR) payloads in the shared 'cache:nuxt:payload' storage using only the URL path as a key, failing to account for authentication headers, cookies, or 'Vary' dimensions. Consequently, if an authenticated user triggers a cache 'warm,' subsequent requests for the '/_payload.json' endpoint by unauthenticated or different authenticated users will receive the cached data, bypassing route middleware and page guards. This leads to the disclosure of sensitive data loaded via useFetch or useAsyncData. The issue was fixed in version 4.5.1 by restricting payload cache operations to the prerendering phase.
Affected products
- Nuxt nuxt >= 4.4.0, <= 4.5.0
Timeline
- 2026-07-27: disclosed: Initial disclosure to Nuxt maintainers
- 2026-07-27: patched: Fix released in version 4.5.1
- 2026-08-05: advisory: GitHub Advisory published