← Vulnerability feed

Vulnerability record · CVE-2026-71316 · published 5 August 2026

CVE-2026-71316: Missing authorization vulnerability

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.

7.5 CVSS 3.1 High EPSS 0.51% · top 59.2% CWE-524 · CWE-524CWE-862 · Missing authorization Deferred
7.5CVSS 3.1 base score
0.51%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
3References
8 Sep 2026Last modified by NVD

Description

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

LinkTags
https://github.com/nuxt/nuxt/commit/ac9b41a36b62296a117862254ee7d2b21a2a5203
https://github.com/nuxt/nuxt/releases/tag/v4.5.1
https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43

Track CVE-2026-71316 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-71316), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.