Read the docs
TI-2026-40666 Aliases CVE-2026-56301GHSA-534h-c3cw-v3h9

Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Priority LOW 29CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00149 4th percentileScored 2026-11-07
Fix Fixed Nuxt (Nuxt): 4.4.7, 3.21.7nuxt (npm): 4.4.7, 3.21.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtNuxt4.0.0 to before 4.4.74.4.7Patch availableCNA
nuxtNuxt3.18.0 to before 3.21.73.21.7Patch availableCNA
—nuxt (npm)4.0.0 to before 4.4.74.4.7Patch availableGHSA-534h-c3cw-v3h9
—nuxt (npm)3.18.0 to before 3.21.73.21.7Patch availableGHSA-534h-c3cw-v3h9
  • Nuxt Vendornuxt Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available CNA
  • Nuxt Vendornuxt Affected 3.18.0 to before 3.21.7 Fixed in 3.21.7 Patch available CNA
  • nuxt (npm) Vendor— Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available GHSA-534h-c3cw-v3h9
  • nuxt (npm) Vendor— Affected 3.18.0 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-534h-c3cw-v3h9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*3.18.0 to before 3.21.7; 4.0.0 to before 4.4.7Vulnerablenuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions 3.18.0 to before 3.21.7; 4.0.0 to before 4.4.7 Vulnerable ·nuxt

Remediation

  • Fix · CNA Nuxt (Nuxt) Fixed in 4.4.7
  • Fix · CNA Nuxt (Nuxt) Fixed in 3.21.7
  • Fix · GHSA-534h-c3cw-v3h9 nuxt (npm) Fixed in 4.4.7 Advisory →
  • Fix · GHSA-534h-c3cw-v3h9 nuxt (npm) Fixed in 3.21.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56301
  2. 2026-10-03 Alias added: GHSA-534h-c3cw-v3h9

References

Patch 2

Advisory 2

Other 1

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2026-34788 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CVSS 4.0MEDIUM 6.3
  • TI-2024-22684 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVSS 3.1MEDIUM 6.3
  • TI-2023-00833 Cross-site Scripting (XSS) - Generic in nuxt/framework CVSS 3.1MEDIUM 6.1
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences