Nuxt, an open‑source Vue.js framework, had a flaw in its runtime cache that allowed a server to serve /<page>/_payload.json files containing a previous user’s server‑side rendered (SSR) data before route middleware and page guards were executed. Because import.meta.prerender was not enforced, the cached payload could be returned to any client, exposing sensitive data that was not intended for that client. The vulnerability is a pure data confidentiality issue that lets a user read another user’s SSR content via a public endpoint.

All Nuxt applications using versions from 4.4.0 through 4.5.0 are affected. Users of Nuxt 4.5.1 or newer are not impacted as the issue was fixed in that release.

The CVSS score of 7.5 classifies the issue as a high impact vulnerability. The attack is possible over the network by simply accessing the /<page>/_payload.json endpoint. Since the issue is not listed in KEV and no EPSS information is available, the exploitation likelihood is unknown but the design flaw makes it straightforward to abuse. Remote clients can read stale SSR data of any authenticated user without authentication, effectively breaching confidentiality of application state.