Read the docs
TI-2026-33412 Aliases CVE-2026-45670GHSA-6m52-m754-pw2g

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Priority MEDIUM 60CWE-749Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.6 and 4.4.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed nuxt (nuxt): 3.21.6, 4.4.6@nuxt/rspack-builder (npm): 3.21.6, 4.4.6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt3.15.4 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.63.21.6, 4.4.6Patch availableCNA
—@nuxt/rspack-builder (npm)3.15.4 to before 3.21.63.21.6Patch availableGHSA-6m52-m754-pw2g
—@nuxt/rspack-builder (npm)4.0.0-alpha.1 to before 4.4.64.4.6Patch availableGHSA-6m52-m754-pw2g
—@nuxt/webpack-builder (npm)3.15.4 to before 3.21.63.21.6Patch availableGHSA-6m52-m754-pw2g
—@nuxt/webpack-builder (npm)4.0.0-alpha.1 to before 4.4.64.4.6Patch availableGHSA-6m52-m754-pw2g
  • nuxt Vendornuxt Affected 3.15.4 to before 3.21.6; 4.0.0-alpha.1 to before 4.4.6 Fixed in 3.21.6, 4.4.6 Patch available CNA
  • @nuxt/rspack-builder (npm) Vendor— Affected 3.15.4 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-6m52-m754-pw2g
  • @nuxt/rspack-builder (npm) Vendor— Affected 4.0.0-alpha.1 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-6m52-m754-pw2g
  • @nuxt/webpack-builder (npm) Vendor— Affected 3.15.4 to before 3.21.6 Fixed in 3.21.6 Patch available GHSA-6m52-m754-pw2g
  • @nuxt/webpack-builder (npm) Vendor— Affected 4.0.0-alpha.1 to before 4.4.6 Fixed in 4.4.6 Patch available GHSA-6m52-m754-pw2g

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt\/rspack-builder:*:*:*:*:*:node.js:*:*3.12.2 to before 3.21.5; 4.0.0 to before 4.4.5Vulnerablenuxt
cpe:2.3:a:nuxt:nuxt\/webpack-builder:*:*:*:*:*:node.js:*:*3.0.0 to before 3.21.5; 4.0.0 to before 4.4.5Vulnerablenuxt
  • cpe:2.3:a:nuxt:nuxt\/rspack-builder:*:*:*:*:*:node.js:*:* Versions 3.12.2 to before 3.21.5; 4.0.0 to before 4.4.5 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:nuxt\/webpack-builder:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.21.5; 4.0.0 to before 4.4.5 Vulnerable ·nuxt

Remediation

  • Fix · CNA nuxt (nuxt) Fixed in 3.21.6, 4.4.6
  • Fix · GHSA-6m52-m754-pw2g @nuxt/rspack-builder (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-6m52-m754-pw2g @nuxt/rspack-builder (npm) Fixed in 4.4.6 Advisory →
  • Fix · GHSA-6m52-m754-pw2g @nuxt/webpack-builder (npm) Fixed in 3.21.6 Advisory →
  • Fix · GHSA-6m52-m754-pw2g @nuxt/webpack-builder (npm) Fixed in 4.4.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45670
  2. 2026-10-03 Alias added: GHSA-6m52-m754-pw2g

References

Exploit 2

Advisory 1

Other 2

  • TI-2026-36824 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when… CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences