CVE-2026-71316: CVE-2026-71316: Information Disclosure and Authorization Bypass in Nuxt Runtime Payload Caching

#security #cve #cybersecurity

CVE-2026-71316: Information Disclosure and Authorization Bypass in Nuxt Runtime Payload Caching

Vulnerability ID: CVE-2026-71316
CVSS Score: 7.5
Published: 2026-08-05

CVE-2026-71316 is a high-severity vulnerability affecting the Nuxt web development framework in versions 4.4.0 up to (but excluding) 4.5.1. Due to the lack of runtime isolation in the shared server runtime storage driver, unauthenticated remote attackers can query the static-like JSON representation of a route's server-side rendered (SSR) state (_payload.json) and bypass configured page guards and application middleware to obtain highly sensitive user session records.

TL;DR

Nuxt version 4.4.0 introduced runtime payload caching across a globally shared storage keyspace. Because cache keys are derived strictly from the request path and are evaluated prior to route middleware execution, unauthenticated attackers can retrieve cached SSR payload files containing the private hydrated state of authorized users.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-524, CWE-862
Attack Vector: Network (AV:N)
CVSS v3.1: 7.5 (High)
EPSS Score: Not Assigned
Vulnerability Impact: Information Disclosure & Authorization Bypass
Exploit Status: Proof-of-Concept / Technical Analysis Available
CISA KEV Status: Not Listed

Affected Systems

Nuxt Web Framework
Nuxt: >= 4.4.0, < 4.5.1 (Fixed in: 4.5.1)

Code Analysis

Commit: ac9b41a

Restrict payload cache to prerendering to prevent runtime payload leaks and middleware bypass

@@ -141,8 +141,11 @@
-    if (payloadCache && await payloadCache.hasItem(cacheKey)) {
+    if (import.meta.prerender && payloadCache && await payloadCache.hasItem(cacheKey)) {

Mitigation Strategies

Disable Runtime Payload Extraction in Nuxt configuration.
Avoid applying hybrid caching rules (SWR/ISR) on user-specific or authenticated endpoints.
Set aggressive reverse-proxy / CDN rules to block or validate authentication for any file paths ending in _payload.json.

Remediation Steps:

Run 'npm install nuxt@4.5.1' or your package manager's equivalent command to upgrade dependencies.
Clear any active runtime payload caches using the target server storage CLI tools or cache adapters.
Execute a hard invalidation and purge across all CDN nodes (e.g. Cloudflare, CloudFront) to delete stale _payload.json cache slices.

References

Read the full report for CVE-2026-71316 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community