Read the docs
TI-2026-50979 Aliases CVE-2026-72744GHSA-7c4v-fwgw-9rf7

Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed nuxt (nuxt): 4.5.1, 3.21.10nuxt (npm): 4.5.1, 3.21.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt4.4.7 to before 4.5.14.5.1Patch availableCNA
nuxtnuxt3.21.7 to before 3.21.103.21.10Patch availableCNA
—nuxt (npm)4.4.7 to before 4.5.14.5.1Patch availableGHSA-7c4v-fwgw-9rf7
—nuxt (npm)3.21.7 to before 3.21.103.21.10Patch availableGHSA-7c4v-fwgw-9rf7
  • nuxt Vendornuxt Affected 4.4.7 to before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • nuxt Vendornuxt Affected 3.21.7 to before 3.21.10 Fixed in 3.21.10 Patch available CNA
  • nuxt (npm) Vendor— Affected 4.4.7 to before 4.5.1 Fixed in 4.5.1 Patch available GHSA-7c4v-fwgw-9rf7
  • nuxt (npm) Vendor— Affected 3.21.7 to before 3.21.10 Fixed in 3.21.10 Patch available GHSA-7c4v-fwgw-9rf7

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*——nuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions — — ·nuxt

Remediation

  • Fix · CNA nuxt (nuxt) Fixed in 4.5.1
  • Fix · CNA nuxt (nuxt) Fixed in 3.21.10
  • Fix · GHSA-7c4v-fwgw-9rf7 nuxt (npm) Fixed in 4.5.1 Advisory →
  • Fix · GHSA-7c4v-fwgw-9rf7 nuxt (npm) Fixed in 3.21.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72744
  2. 2026-10-03 Alias added: GHSA-7c4v-fwgw-9rf7

References

Advisory 2

Other 5

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
  • TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
  • TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences