# CVE-2026-71316: Nuxt sensitive information disclosure in runtime payload cache

Source: https://junglewise.ai/threats/cve-2026-71316-nuxt-sensitive-information-disclosure-in-runtime-payload-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-05. Updated: 2026-08-05  
License: CC BY 4.0 with a link back

CVE-2026-71316 · Severity: high · CVSS 7.5 · Published 2026-08-05

Nuxt, a popular web development framework, contains a vulnerability where sensitive user data can be accidentally shared with other users or unauthorized visitors. When certain caching features are enabled, the system may store a user's private information (like profile details or billing data) and serve it to the next person who visits the same page. This could lead to significant data leaks and privacy violations for applications handling personal user information.

Technologies: [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-71316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71316 being exploited in the wild.

**How severe is CVE-2026-71316?** High severity, with a CVSS score of 7.5, published 5 August 2026.

**Which products and versions are affected?** nuxt (npm) >= 4.4.0, <= 4.5.0, SEMVER:introduced=4.4.0,fixed=4.5.1.

**Is there a fix for CVE-2026-71316?** Yes. nuxt (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71316 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71316?** Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nuxt (npm): upgrade to 4.5.1 or later

  ```sh
  npm install nuxt@4.5.1
  ```


## Technical details

A vulnerability in Nuxt 4.x (v4.4.0 to v4.5.0) occurs when runtime payload extraction is enabled via routeRules (cache, swr, or isr). The renderer stores Server-Side Rendering (SSR) payloads in the shared 'cache:nuxt:payload' storage using only the URL path as a key, failing to account for authentication headers, cookies, or 'Vary' dimensions. Consequently, if an authenticated user triggers a cache 'warm,' subsequent requests for the '/_payload.json' endpoint by unauthenticated or different authenticated users will receive the cached data, bypassing route middleware and page guards. This leads to the disclosure of sensitive data loaded via useFetch or useAsyncData. The issue was fixed in version 4.5.1 by restricting payload cache operations to the prerendering phase.

## Affected products

- Nuxt nuxt >= 4.4.0, <= 4.5.0

## Identifiers

- CVE-2026-71316
- GHSA-wm8w-6qjm-cv43

## Timeline

- 2026-07-27: disclosed: Initial disclosure to Nuxt maintainers
- 2026-07-27: patched: Fix released in version 4.5.1
- 2026-08-05: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/quantumshiro](https://api.github.com/users/quantumshiro)
- [https://github.com/quantumshiro](https://github.com/quantumshiro)
- [https://api.github.com/users/quantumshiro/gists%7B/gist_id%7D](https://api.github.com/users/quantumshiro/gists%7B/gist_id%7D)
- [https://api.github.com/users/quantumshiro/repos](https://api.github.com/users/quantumshiro/repos)
- [https://avatars.githubusercontent.com/u/75029815?v=4](https://avatars.githubusercontent.com/u/75029815?v=4)
- [https://api.github.com/users/quantumshiro/events%7B/privacy%7D](https://api.github.com/users/quantumshiro/events%7B/privacy%7D)

## Related threats

- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt case-sensitive route matching bypass](https://junglewise.ai/threats/cve-2026-114132-nuxt-is-an-open-source-web-development-framework-for-vue-js)
- [Nuxt route-rule bypass via percent-encoded segments](https://junglewise.ai/threats/cve-2026-114131-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt XSS via protocol bypass in NuxtLink](https://junglewise.ai/threats/cve-2026-114130-nuxt-is-an-open-source-web-development-framework-for-vue-js)