https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:53:04 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71316 <p>Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /&lt;page&gt;/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user&#39;s SSR data. This issue is fixed in 4.5.1.</p> <p>Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /&lt;page&gt;/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user&#39;s SSR data. This issue is fixed in 4.5.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71316 https://vulnerability.circl.lu/vuln/ghsa-wm8w-6qjm-cv43 <p><strong>Affected:</strong> npm: nuxt</p> <p>### Impact</p> <p>When a page is covered by `routeRules` `cache` / `swr` / `isr`, Nuxt enables runtime payload extraction and serves `/&lt;page&gt;/_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no cookie, `authorization`, or `cache.varies` dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again.</p> <p>As a result, once any authenticated user warms a protected, cached page, a subsequent `GET /&lt;page&gt;/_payload.json` from an unauthenticated client or a different authenticated user receives the first user&#39;s payload: the full SSR data for that route, including anything loaded via `useFetch` / `useAsyncData` (for example `/api/me`: profile, tenant, billing, token-like values). The HTML response stays correctly varied and protected; only the extracted payload leaks. Both cross-user (A warms, B receives A) and unauthenticated disclosure are exploitable. `cache.varies` does not mitigate it, because the payload cache ignores `varies`.</p> <p>Introduced when runtime payload extraction landed for cached routes (#34410); the regression is specific to the 4.x line, where the runtime `cache:nuxt:payload` storage was added and the `import.meta.prerender` gate on the payload-cache read/writes was dropped. The 3.x line shipped the same feature with the gate intact and is not affected.</p> <p>### Patches</p> <p>Fixed in `nuxt@4.5.1`. Runtime payload-cache reads and writes are…</p> <p><strong>Affected:</strong> npm: nuxt</p> <p>### Impact</p> <p>When a page is covered by `routeRules` `cache` / `swr` / `isr`, Nuxt enables runtime payload extraction and serves `/&lt;page&gt;/_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no cookie, `authorization`, or `cache.varies` dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again.</p> <p>As a result, once any authenticated user warms a protected, cached page, a subsequent `GET /&lt;page&gt;/_payload.json` from an unauthenticated client or a different authenticated user receives the first user&#39;s payload: the full SSR data for that route, including anything loaded via `useFetch` / `useAsyncData` (for example `/api/me`: profile, tenant, billing, token-like values). The HTML response stays correctly varied and protected; only the extracted payload leaks. Both cross-user (A warms, B receives A) and unauthenticated disclosure are exploitable. `cache.varies` does not mitigate it, because the payload cache ignores `varies`.</p> <p>Introduced when runtime payload extraction landed for cached routes (#34410); the regression is specific to the 4.x line, where the runtime `cache:nuxt:payload` storage was added and the `import.meta.prerender` gate on the payload-cache read/writes was dropped. The 3.x line shipped the same feature with the gate intact and is not affected.</p> <p>### Patches</p> <p>Fixed in `nuxt@4.5.1`. Runtime payload-cache reads and writes are…</p> https://vulnerability.circl.lu/vuln/ghsa-wm8w-6qjm-cv43