Read the docs
TI-2026-36824 Aliases CVE-2026-49993GHSA-x6qj-4h56-5rj5

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when…

Priority MEDIUM 60CWE-749Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed nuxt (nuxt): 3.21.7, 4.4.7@nuxt/webpack-builder (npm): 4.4.7, 3.21.7+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt3.15.4 to before 3.21.7; 4.0.0 to before 4.4.73.21.7, 4.4.7Patch availableCNA
—@nuxt/webpack-builder (npm)4.0.0 to before 4.4.74.4.7Patch availableGHSA-x6qj-4h56-5rj5
—@nuxt/webpack-builder (npm)3.15.4 to before 3.21.73.21.7Patch availableGHSA-x6qj-4h56-5rj5
—@nuxt/rspack-builder (npm)4.0.0 to before 4.4.74.4.7Patch availableGHSA-x6qj-4h56-5rj5
—@nuxt/rspack-builder (npm)3.15.4 to before 3.21.73.21.7Patch availableGHSA-x6qj-4h56-5rj5
  • nuxt Vendornuxt Affected 3.15.4 to before 3.21.7; 4.0.0 to before 4.4.7 Fixed in 3.21.7, 4.4.7 Patch available CNA
  • @nuxt/webpack-builder (npm) Vendor— Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available GHSA-x6qj-4h56-5rj5
  • @nuxt/webpack-builder (npm) Vendor— Affected 3.15.4 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-x6qj-4h56-5rj5
  • @nuxt/rspack-builder (npm) Vendor— Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available GHSA-x6qj-4h56-5rj5
  • @nuxt/rspack-builder (npm) Vendor— Affected 3.15.4 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-x6qj-4h56-5rj5

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt\/rspack-builder:*:*:*:*:*:node.js:*:*3.15.4 to before 3.21.7; 4.0.0 to before 4.4.7Vulnerablenuxt
cpe:2.3:a:nuxt:nuxt\/webpack-builder:*:*:*:*:*:node.js:*:*3.15.4 to before 3.21.7; 4.0.0 to before 4.4.7Vulnerablenuxt
  • cpe:2.3:a:nuxt:nuxt\/rspack-builder:*:*:*:*:*:node.js:*:* Versions 3.15.4 to before 3.21.7; 4.0.0 to before 4.4.7 Vulnerable ·nuxt
  • cpe:2.3:a:nuxt:nuxt\/webpack-builder:*:*:*:*:*:node.js:*:* Versions 3.15.4 to before 3.21.7; 4.0.0 to before 4.4.7 Vulnerable ·nuxt

Remediation

  • Fix · CNA nuxt (nuxt) Fixed in 3.21.7, 4.4.7
  • Fix · GHSA-x6qj-4h56-5rj5 @nuxt/webpack-builder (npm) Fixed in 4.4.7 Advisory →
  • Fix · GHSA-x6qj-4h56-5rj5 @nuxt/webpack-builder (npm) Fixed in 3.21.7 Advisory →
  • Fix · GHSA-x6qj-4h56-5rj5 @nuxt/rspack-builder (npm) Fixed in 4.4.7 Advisory →
  • Fix · GHSA-x6qj-4h56-5rj5 @nuxt/rspack-builder (npm) Fixed in 3.21.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49993
  2. 2026-10-03 Alias added: GHSA-x6qj-4h56-5rj5

References

Exploit 2

Patch 2

Advisory 1

Other 2

  • TI-2026-33412 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CVSS 4.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences