{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/nuxt-4.0.0-4.5.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nuxt (4.4.0, 4.5.0)","nuxt (3.x)","nuxt (4.x)","Nuxt (3.4.0-3.21.9)","Nuxt (4.0.0-4.5.0)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","nuxt","template-injection","cve-2026-71320"],"_cs_type":"advisory","_cs_vendors":["Nuxt"],"content_html":"\u003cp\u003eNuxt versions 4.4.0 through 4.5.0 contain a vulnerability (CVE-2026-71316) where the runtime payload cache incorrectly stores and retrieves data. The vulnerability resides in the \u003ccode\u003ecache:nuxt:payload\u003c/code\u003e storage, which utilizes a path-only cache key, ignoring session-specific context such as cookies, authorization headers, or cache variations. This allows an attacker to access sensitive SSR data by requesting the \u003ccode\u003e/_payload.json\u003c/code\u003e endpoint for routes that have been previously 'warmed' by an authenticated user. The SSR data typically includes results from \u003ccode\u003euseFetch\u003c/code\u003e or \u003ccode\u003euseAsyncData\u003c/code\u003e, which may contain private information like profile details, tenant identifiers, or billing data. The issue is specific to the 4.x release line and was caused by a regression where runtime payload-cache reads and writes were no longer restricted to the prerendering phase.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe target application is configured with \u003ccode\u003erouteRules\u003c/code\u003e using \u003ccode\u003ecache\u003c/code\u003e, \u003ccode\u003eswr\u003c/code\u003e, or \u003ccode\u003eisr\u003c/code\u003e on protected pages that display user-specific data.\u003c/li\u003e\n\u003cli\u003eAn authenticated user accesses a protected, cached route, triggering the server to generate and store the SSR payload in the \u003ccode\u003ecache:nuxt:payload\u003c/code\u003e store.\u003c/li\u003e\n\u003cli\u003eThe cached payload is stored using only the URL path as the key, lacking any session or authorization awareness.\u003c/li\u003e\n\u003cli\u003eAn attacker or an unauthorized user identifies a target path that utilizes Nuxt payload extraction.\u003c/li\u003e\n\u003cli\u003eThe attacker issues a \u003ccode\u003eGET\u003c/code\u003e request to \u003ccode\u003e/\u0026lt;target-path\u0026gt;/_payload.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Nuxt renderer retrieves the stored payload from the shared cache before any route middleware, page guards, or authorization checks are executed.\u003c/li\u003e\n\u003cli\u003eThe sensitive payload, intended only for the original authenticated user, is returned to the unauthorized requester in the response body.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized access to sensitive application data rendered during SSR. This exposure impacts users across different sessions, including the disclosure of profile information, billing details, and internal application data to unauthenticated clients. Any application relying on Nuxt 4.4.0-4.5.0 with caching enabled on authenticated routes is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003enuxt@4.5.1\u003c/code\u003e immediately to restore proper prerendering gates on payload caching.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, set \u003ccode\u003eexperimental.payloadExtraction: false\u003c/code\u003e in the Nuxt configuration to disable the vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eAudit \u003ccode\u003erouteRules\u003c/code\u003e to remove \u003ccode\u003ecache\u003c/code\u003e, \u003ccode\u003eswr\u003c/code\u003e, or \u003ccode\u003eisr\u003c/code\u003e configurations from pages that display user-specific data.\u003c/li\u003e\n\u003cli\u003eImplement authentication requirements at the edge, such as CDN or proxy-level, specifically for \u003ccode\u003e/**/_payload.json\u003c/code\u003e paths as a temporary defense-in-depth measure.\u003c/li\u003e\n\u003cli\u003ePurge CDN and platform caches after applying security updates to ensure potentially leaked payloads are removed from intermediate storage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T03:26:07Z","date_published":"2026-08-05T21:25:24Z","id":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-payload-leak/","summary":"A vulnerability in Nuxt 4.4.0 through 4.5.0 causes sensitive SSR data in the payload cache to be disclosed to unauthorized users due to an insufficient cache key implementation.","title":"Nuxt 4.x Runtime Payload Cache Disclosure","url":"https://feed.craftedsignal.io/briefs/2026-08-nuxt-payload-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Nuxt (4.0.0-4.5.0)","version":"https://jsonfeed.org/version/1.1"}