GHSA-wm8w-6qjm-cv43 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

• npm nuxt: >= 4.4.0, < 4.5.1 → fixed in 4.5.1

Impact When a page is covered by `routeRules` `cache` / `swr` / `isr`, Nuxt enables runtime payload extraction and serves `//_payload.json`. On affected versions the renderer stored the SSR payload in the shared `cache:nuxt:payload` storage under a path-only key (no cookie, `authorization`, or `cache.varies` dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again. As a result, once any authenticated user warms a protected, cached page, a subsequent `GET //_payload.json` from an unauthenticated client or a different authenticated user receives the first user's payload: the full SSR data for that route, including anything loaded via `useFetch` / `useAsyncData` (for example `/api/me`: profile, tenant, billing, token-like values). The HTML response stays correctly varied and protected; only the extracted payload leaks. Both cross-user (A warms, B receives A) and unauthenticated disclosure are exploitable. `cache.varies` does not mitigate it, because the payload cache ignores `varies`. Introduced when runtime payload extraction landed for cached routes (#34410); the regression is specific to the 4.x line, where the runtime `cache:nuxt:payload` storage was added and the `import.meta.prerender` gate on the payload-cache read/writes was dropped. The 3.x line shipped the same feature with the gate intact and is not affected. Patches Fixed in `[email protected]`. Runtime payload-cache reads and writes are again confined to prerendering (`import.meta.prerender`); at runtime, `//_payload.json` follows the normal render path so route middleware, `routeRules.appMiddleware`, and page guards run for the current request. `main` / v5 and the `3.x` line already had this property, so 3.x is not affected. Workarounds • Set `experimental.payloadExtraction: false` (reporter-validated): the standalone `/_payload.json` endpoint returns 404 and the page still serves a 200 with an inline payload. • Do not apply `cache` / `swr` / `isr` to authenticated pages that render user-specific SSR data. • As defense-in-depth, require authentication for `/**/_payload.json` at a proxy / CDN. • After upgrading, purge any CDN / platform cache that may already hold protected payloads.