CVE-2026-71316: 
Nuxt Analyse et atténuation des vulnérabilités

CVE-2026-71316 is a server-side rendering (SSR) payload cache disclosure vulnerability in the Nuxt web framework for Vue.js. Affecting versions 4.4.0 through 4.5.0 (inclusive), the flaw causes the runtime cache:nuxt:payload storage to serve cached SSR payload data from /<page>/_payload.json endpoints without enforcing route middleware or page guards, disclosing one user's SSR data to other users or unauthenticated clients. The vulnerability was introduced with the runtime payload extraction feature for cached routes (PR #34410) and is specific to the 4.x line; Nuxt 3.x is not affected. It was published on July 27, 2026 and carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is classified under CWE-524 (Use of Cache Containing Sensitive Information) and CWE-862 (Missing Authorization). When a page is covered by routeRules with cache, swr, or isr, Nuxt 4.x stores the SSR payload in the shared cache:nuxt:payload storage keyed only by URL path — with no cookie, authorization header, or cache.varies dimension included in the cache key. The import.meta.prerender gate that previously confined payload cache reads and writes to prerendering was inadvertently dropped in the 4.x line, allowing runtime requests to /_payload.json to be served directly from cache before route middleware or page guards execute. The fix (commit ac9b41a) re-introduces the import.meta.prerender guard so that at runtime, /_payload.json requests always follow the full render path (Github Advisory, Patch Commit).

Successful exploitation results in high confidentiality impact with no integrity or availability impact. Once any authenticated user warms a protected cached page, a subsequent unauthenticated or differently-authenticated GET /<page>/_payload.json request receives the first user's full SSR payload — including data loaded via useFetch or useAsyncData such as user profiles, tenant identifiers, billing information, and token-like values. The HTML response itself remains correctly varied and protected; only the extracted JSON payload leaks. Both cross-user disclosure (user A's data served to user B) and unauthenticated disclosure are exploitable, and cache.varies does not mitigate the issue because the payload cache ignores that configuration (Github Advisory).

1. Reconnaissance: Identify a Nuxt 4.x application (versions 4.4.0–4.5.0) that uses routeRules with cache, swr, or isr on pages that render user-specific SSR data (e.g., profile pages, dashboards).
2. Cache warming (passive or active): Wait for or trigger a legitimate authenticated user to visit a protected cached page (e.g., /protected/profile), which causes the server to store the SSR payload in cache:nuxt:payload under the path-only key.
3. Payload extraction: Send an unauthenticated HTTP GET request directly to the payload endpoint: GET /protected/profile/_payload.json. Because the cache is keyed by path alone and the import.meta.prerender gate is absent, the server returns the cached payload without running route middleware or page guards.
4. Data harvesting: Parse the returned JSON payload to extract sensitive SSR data such as user profile fields, tenant identifiers, billing details, or token-like values that were loaded via useFetch/useAsyncData during the authenticated user's session (Github Advisory).

• Network: Unusual or repeated unauthenticated GET requests to /_payload.json endpoints (e.g., GET /protected/<page>/_payload.json) without corresponding session cookies or authorization headers in server access logs.
• Network: Requests to /_payload.json paths originating from IPs or user agents that have not previously authenticated or visited the parent page.
• Logs: Server access logs showing 200 OK responses to /_payload.json requests from clients lacking valid session cookies or authorization tokens.
• Logs: Anomalous access patterns where /_payload.json is fetched significantly more frequently than the parent HTML page, suggesting automated harvesting.

Upgrade to nuxt@4.5.1, which confines runtime payload cache reads and writes to prerendering via the import.meta.prerender gate, ensuring /_payload.json requests at runtime always execute route middleware and page guards (Nuxt Release). If immediate upgrade is not possible, set experimental.payloadExtraction: false in your Nuxt config — this disables the standalone /_payload.json endpoint (returns 404) while the page continues to serve an inline payload with a 200 response. As additional mitigations: do not apply cache/swr/isr route rules to pages that render user-specific SSR data; require authentication for /**/_payload.json at the proxy or CDN layer. After upgrading, purge any CDN or platform cache that may already hold leaked payloads (Github Advisory).

The vulnerability was published by Nuxt maintainer danielroe as part of a broader security release (v4.5.1) that also addressed server-side RCE, unauthorized component instantiation, route rule authorization bypass, and server component DoS issues. The release notes explicitly recommend upgrading as soon as possible and note that users who had already upgraded for the earlier CVE-2026-53721 advisory still need this release. Social media mentions were observed on Mastodon and Bluesky shortly after disclosure (Nuxt Release).