CVE-2026-71316

creationtimestamp| type| source ---|---|--- 2026-08-06 00:00:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mseqdchgvo2t 2026-08-06 04:31:21+00:00| seen| https://gist.github.com/alon710/a33e8f1d3990c5613ef07342bcfbda1b...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +13 more potentially affected by CVE-2026-71316 via nuxt (>=4.4.2, <=4.5.0)

nuxt NPM version =4.4.2, =3.2.0, =1.4.4, =1.2.1, =1.6.0-rc.3, =1.0.0-alpha.1, =4.3.1-dev.1, =1.0.0, =0.6.0-rc.1, =0.2.0-alpha.5, =1.0.0-alpha.1, =9.1.1, =9.2.11 Source cves: CVE-2026-71316 Source advisory: OSV:GHSA-WM8W-6QJM-CV43...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +15 more potentially affected by CVE-2026-71316 via @nuxt/nitro-server (>=4.4.2, <=4.5.0)

@nuxt/nitro-server NPM version =4.4.2, =3.2.0, =4.4.2-depup.0, =1.4.4, =1.2.1, =1.6.0-rc.3, =1.0.0-alpha.1, =4.3.1-dev.1, =1.0.0, =4.4.2, =0.6.0-rc.1, =0.2.0-alpha.5, =0.3.0-alpha.2 and more Source cves: CVE-2026-71316 Source advisory: SNYK:JS-NUXTNITROSERVER-18565121...

CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...