CVE-2026-71316: Nuxt sensitive information disclosure in runtime payload cache

CVE-2026-71316 · Severity: high · CVSS 7.5 · Published 2026-08-05

Nuxt, a popular web development framework, contains a vulnerability where sensitive user data can be accidentally shared with other users or unauthorized visitors. When certain caching features are enabled, the system may store a user's private information (like profile details or billing data) and serve it to the next person who visits the same page. This could lead to significant data leaks and privacy violations for applications handling personal user information.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-71316 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71316 being exploited in the wild.
How severe is CVE-2026-71316?
High severity, with a CVSS score of 7.5, published 5 August 2026.
Which products and versions are affected?
nuxt (npm) >= 4.4.0, <= 4.5.0, SEMVER:introduced=4.4.0,fixed=4.5.1.
Is there a fix for CVE-2026-71316?
Yes. nuxt (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71316 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71316?
Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt (npm): upgrade to 4.5.1 or later
    npm install nuxt@4.5.1

Technical details

A vulnerability in Nuxt 4.x (v4.4.0 to v4.5.0) occurs when runtime payload extraction is enabled via routeRules (cache, swr, or isr). The renderer stores Server-Side Rendering (SSR) payloads in the shared 'cache:nuxt:payload' storage using only the URL path as a key, failing to account for authentication headers, cookies, or 'Vary' dimensions. Consequently, if an authenticated user triggers a cache 'warm,' subsequent requests for the '/_payload.json' endpoint by unauthenticated or different authenticated users will receive the cached data, bypassing route middleware and page guards. This leads to the disclosure of sensitive data loaded via useFetch or useAsyncData. The issue was fixed in version 4.5.1 by restricting payload cache operations to the prerendering phase.

Affected products

  • Nuxt nuxt >= 4.4.0, <= 4.5.0

Identifiers

  • CVE-2026-71316
  • GHSA-wm8w-6qjm-cv43

Timeline

  • 2026-07-27: disclosed: Initial disclosure to Nuxt maintainers
  • 2026-07-27: patched: Fix released in version 4.5.1
  • 2026-08-05: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.