CVE-2026-71316

About vulnerability

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user’s SSR data. This issue is fixed in 4.5.1.

Affected product:

Vue , ai-sdk-angular , ai-sdk-assemblyai , ai-sdk-cerebras , ai-sdk-deepgram , ai-sdk-deepinfra , ai-sdk-deepseek , ai-sdk-elevenlabs , ai-sdk-fal , ai-sdk-gateway , ai-sdk-gladia , ai-sdk-harness , ai-sdk-harness-codex , ai-sdk-harness-cursor , ai-sdk-harness-deepagents , ai-sdk-harness-fx , ai-sdk-harness-opencode , ai-sdk-harness-pi , ai-sdk-hume , ai-sdk-langchain , ai-sdk-llamaindex , ai-sdk-lmnt , ai-sdk-luma , ai-sdk-otel , ai-sdk-policy-opa , ai-sdk-replicate , ai-sdk-revai , ai-sdk-rsc , ai-sdk-sandbox-just-bash , ai-sdk-sandbox-vercel , ai-sdk-togetherai , ai-sdk-valibot , ai-sdk-vercel , ai-sdk-workflow , ai-sdk-workflow-harness , clerk-nuxt , devtools , nuxt , nuxt-cli , nuxt-devtools-kit , nuxt-devtools-ui-kit , nuxt-docs , nuxt-kit , nuxt-nitro-server , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-vite-server , nuxt-webpack-builder , sentry-nuxt , telemetry , wdio , wdio-ai-service , wdio-browser-runner , wdio-concise-reporter , wdio-config , wdio-display-server , wdio-firefox-profile-service , wdio-jasmine-framework , wdio-json-reporter , wdio-lighthouse-service , wdio-sauce-service , wdio-session , wdio-shared-store-service , wdio-smoke-test-reporter , wdio-static-server-service , wdio-sumologic-reporter , wdio-testingbot-service , wdio-utils , wdio-webdriver-mock-service , webdriver , webdriverio , workflow , workflow-ai , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-swc-plugin , workflow-utils , workflow-vite , workflow-vitest , workflow-web , workflow-web-shared , workflow-world , workflow-world-testing , workflow-world-vercel

Affected packages:

nuxt @ 1.4.5 (+1372 more)