Nuxt dev server exposes its generated appSecret file
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-552.
Summary
Nuxt from 4.6.0 before 4.6.3 and @nuxt/vite-builder from 4.6.0 before 4.6.3 are affected. nuxt dev stores a generated appSecret in a file within a directory that Vite's server.fs configuration allows to be served, exposing it (CWE-552). A client with direct HTTP access to an exposed development server can fetch the file, derive session secrets, and forge session cookies that the server accepts. The default localhost binding limits remote exposure, and production builds are not affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nuxt | nuxt | 4.6.0 to before 4.6.3 | 4.6.3 | Patch available | CNA |
| — | @nuxt/vite-builder (npm) | 4.6.0 to before 4.6.3 | 4.6.3 | Patch available | GHSA-3xf4-9g3c-4h4w |
- nuxt Vendornuxt Affected 4.6.0 to before 4.6.3 Fixed in 4.6.3 Patch available CNA
- @nuxt/vite-builder (npm) Vendor— Affected 4.6.0 to before 4.6.3 Fixed in 4.6.3 Patch available GHSA-3xf4-9g3c-4h4w
Remediation
Upgrade nuxt and @nuxt/vite-builder to version 4.6.3, the fixed version named in the source description and the fixedIn value for @nuxt/vite-builder.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA nuxt (nuxt) Fixed in 4.6.3
- Fix · GHSA-3xf4-9g3c-4h4w @nuxt/vite-builder (npm) Fixed in 4.6.3 Advisory →
Timeline
- 2026-10-29 Threatist record created from CVE-2026-119201
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Alias added: GHSA-3xf4-9g3c-4h4w
- 2026-10-30 Fix available: npm/@nuxt/[email protected] · GHSA-3xf4-9g3c-4h4w
- 2026-10-30 CVSS score added · GHSA-3xf4-9g3c-4h4w
- 2026-10-30 Weakness changed · GHSA-3xf4-9g3c-4h4w
- 2026-10-30 6 new references · GHSA-3xf4-9g3c-4h4w
References
Other 5
More nuxt vulnerabilities
- TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
- TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
- TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
- TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
- TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
- TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-119201 · CVE Program
- CVE-2026-119201 · NVD
- FIRST EPSS
- GHSA-3xf4-9g3c-4h4w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences