# Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Nuxt 4.x cached SSR payloads under path-only keys, so unauthenticated or different users could fetch another user's protected _payload.json data.

- Payout: Research
- Severity: high
- Program: Nuxt
- Found by: quantumshiro
- Disclosed: 2026-08-05
- CVE: CVE-2026-71316
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-wm8w-6qjm-cv43
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-wm8w-6qjm-cv43
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:research platform:ghsa sev:high tech:nodejs technique:regression technique:source-review vuln:access-control vuln:cache-deception vuln:info-disclosure

**Target:** Nuxt SSR runtime payload cache endpoint /<page>/_payload.json
**Root cause:** Runtime payload cache stored SSR payloads in shared `cache:nuxt:payload` storage keyed only by path, with no cookie/authorization/cache.varies dimension, and served cached entries before route middleware and page guards re-ran.
**Steps:**
1. Configure a page with `routeRules` `cache`/`swr`/`isr` rendering user-specific data via `useFetch`/`useAsyncData` (e.g. `/api/me`).
2. Authenticated user A visits the page, warming the shared payload cache.
3. Unauthenticated client or user B sends `GET /<page>/_payload.json`.
4. Response returns A's cached SSR payload instead of B's own or a 401.
**How found:** Noticed runtime payload extraction for cached routes stored payloads in shared storage keyed by path only, and that the `import.meta.prerender` gate present in 3.x was dropped in 4.x, letting runtime reads bypass middleware.
**Exploitation:** Attacker requests the extracted payload endpoint for any cached authenticated route after a victim warms it; no auth needed, receives full SSR data including profile, tenant, billing and token-like values. HTML response remains correctly varied, only payload leaks.
**Insight:** When a framework adds a side-channel representation of a page (JSON payload, RSC flight data, hydration blob), check whether its cache key includes the same auth/vary dimensions as the HTML response and whether guards run on that path.