Arbitrary file read in Nuxt dev server through client error reports
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-73 and the CVSS impact.
Summary
Nuxt versions from 4.6.0 before 4.6.3 contain a flaw that lets a client with TCP access to an exposed development server read arbitrary files. The client sends a nuxt:dev:client-error event over the HMR socket with an absolute file path, and the server returns the file contents through the error overlay and terminal report, bypassing Vite's server.fs allow list. The flaw is classified as CWE-73 (external control of file name or path). The default localhost binding limits remote exposure, while production builds and Nuxt 3 are not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nuxt | nuxt | 4.6.0 to before 4.6.3 | 4.6.3 | Patch available | CNA |
| — | @nuxt/vite-builder (npm) | 4.6.0 to before 4.6.3 | 4.6.3 | Patch available | GHSA-x287-wcfc-q46c |
- nuxt Vendornuxt Affected 4.6.0 to before 4.6.3 Fixed in 4.6.3 Patch available CNA
- @nuxt/vite-builder (npm) Vendor— Affected 4.6.0 to before 4.6.3 Fixed in 4.6.3 Patch available GHSA-x287-wcfc-q46c
Remediation
Update nuxt and @nuxt/vite-builder to version 4.6.3, which fixes the issue. Nuxt 3 is not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA nuxt (nuxt) Fixed in 4.6.3
- Fix · GHSA-x287-wcfc-q46c @nuxt/vite-builder (npm) Fixed in 4.6.3 Advisory →
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119198
- 2026-10-30 Alias added: GHSA-x287-wcfc-q46c
- 2026-10-30 Fix available: npm/@nuxt/[email protected] · GHSA-x287-wcfc-q46c
- 2026-10-30 CVSS score added · GHSA-x287-wcfc-q46c
- 2026-10-30 Weakness changed · GHSA-x287-wcfc-q46c
- 2026-10-30 6 new references · GHSA-x287-wcfc-q46c
- 2026-10-31 Priority changed: MEDIUM → LOW
- 2026-11-03 CISA SSVC decision points changed
References
Other 5
More nuxt vulnerabilities
- TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
- TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
- TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
- TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
- TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
- TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-119198 · CVE Program
- CVE-2026-119198 · NVD
- FIRST EPSS
- GHSA-x287-wcfc-q46c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences