Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returne…

A vulnerability in the Nuxt open-source Vue.js web framework (versions 4.4.0 to 4.5.1) allows runtime cache entries for payload JSON files to be returned before route middleware and page guards are enforced. This occurs because import.meta.prerender is not properly enforced, leading to potential disclosure of another user's server-side rendering (SSR) data. The flaw could expose sensitive user information across sessions in affected deployments. The issue has been assigned CVE-2026-71316 and is classified as an information disclosure vulnerability. A fix was released in Nuxt version 4.5.1. Users running affected versions are advised to upgrade immediately to mitigate the risk of cross-user data leakage.