Nuxt EUVD-2026-53646

All three conditions must be simultaneously true for exploitation: (1) The application runs nuxt 4.4.0-4.5.0 - Nuxt 3.x and v5 are not vulnerable. (2) At least one page is covered by a routeRules directive specifying cache, swr, or isr - pages without these rules never populate the payload cache and are not affected. (3) Those cached pages render user-specific SSR data via useFetch or useAsyncData. Additionally, the cache must have been warmed by at least one authenticated user since the last expiry - this is a passive prerequisite that is naturally met in any active production application. The cache.varies configuration does NOT limit exploitation because the payload cache explicitly ignores the varies dimension. The HTML response path is not affected; only requests to the detached /_payload.json endpoint are vulnerable. Cross-user leakage (user A's data to user B) and unauthenticated disclosure are both independently exploitable attack modes.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) accurately captures the attacker's perspective: a single unauthenticated GET request to a known path with no authentication or interaction yields high-confidentiality-impact data. The practical attack complexity is genuinely low for any live application - the cache-warming prerequisite (an authenticated user must have visited the page since last cache expiry) is a passive condition that is almost always already met in production. No EPSS score or CISA KEV listing was provided in the available data, so exploitation probability and confirmed active exploitation cannot be quantified from this dataset. No public exploit code has been identified; however, the patch commit adds a fully functional regression test fixture that demonstrates the exact exploitation path, meaning a working proof-of-concept can be trivially constructed from the advisory alone. Risk is materially elevated for Nuxt 4.x deployments that use routeRules caching on authenticated pages with user-specific SSR data; applications without such a configuration are not affected regardless of upgrade status.

An attacker targets a Nuxt 4.4.x-4.5.0 application where /dashboard is a routeRules-cached page that calls useFetch('/api/me') to load profile and billing data. After any authenticated user navigates to /dashboard, the attacker - with no session or credentials - sends GET /dashboard/_payload.json and immediately receives the first user's full SSR payload, including their name, email, tenant ID, billing tier, and any bearer tokens surfaced by the API. No special tooling is required beyond a standard HTTP client; the response is a plaintext JSON object.