Every CVE Search/ Get API key

CVE-2025-24360

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

5.3 MediumFix available

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.56%Up 0.5 points since Jan 25, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Record
CVE-2025-24360
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2025-0115 5.3

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Record
EUVD-2025-0115
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-2452-6xj8-jh47 5.3

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary

Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.

Details

While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263

That CORS handler sets Access-Control-Allow-Origin: *.

[!IMPORTANT]
If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors.

PoC

  1. Start a dev server in any nuxt project using Vite by nuxt dev.
  2. Send a fetch request to http://localhost:3000/_nuxt/app.vue (fetch('http://localhost:3000/_nuxt/app.vue')) from a different origin page.

Impact

Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites

Additional Information

/__nuxt_vite_node__/manifest / /__nuxt_vite_node__/module also seems to have Access-Control-Allow-Origin: *, so it maybe also possible to exploit that handler. https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39 Although I didn't find a valid module id. Note that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.

Record
GHSA-2452-6xj8-jh47
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 5.3

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Record
CVE-2025-24360
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 5.3

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

Record
CVE-2025-24360
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-2452-6xj8-jh47 5.3

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary

Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.

Details

While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995).

https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263

That CORS handler sets Access-Control-Allow-Origin: *.

[!IMPORTANT]
If on an affected version, it may be possible to opt-out of the default Nuxt CORS handler by configuring vite.server.cors.

PoC

  1. Start a dev server in any nuxt project using Vite by nuxt dev.
  2. Send a fetch request to http://localhost:3000/_nuxt/app.vue (fetch('http://localhost:3000/_nuxt/app.vue')) from a different origin page.

Impact

Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites

Additional Information

/__nuxt_vite_node__/manifest / /__nuxt_vite_node__/module also seems to have Access-Control-Allow-Origin: *, so it maybe also possible to exploit that handler. https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39 Although I didn't find a valid module id. Note that this handler is probably also vulnerable to DNS rebinding attacks as I didn't find any host header checks.

Record
GHSA-2452-6xj8-jh47
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1776040400 No score

TuxCare security update for nuxt (1 CVE)

TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.4-tuxcare.3.

Record
CLSA-2026-1776040400
Updated
2026-11-02
OSVCLSA-2026-1792161444 No score

TuxCare security update for @nuxt/kit (1 CVE)

TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.4-tuxcare.3.

Record
CLSA-2026-1792161444
Updated
2026-11-02
OSVCLSA-2026-1792161585 No score

TuxCare security update for @nuxt/schema (1 CVE)

TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.4-tuxcare.3.

Record
CLSA-2026-1792161585
Updated
2026-11-02
OSVCLSA-2026-1792161808 No score

TuxCare security update for @nuxt/vite-builder (1 CVE)

TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.3.

Record
CLSA-2026-1792161808
Updated
2026-11-02
OSVCLSA-2026-1792161921 No score

TuxCare security update for @nuxt/webpack-builder (1 CVE)

TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.3.

Record
CLSA-2026-1792161921
Updated
2026-11-02
OSVCLSA-2026-1792232953 No score

TuxCare security update for nuxt (1 CVE)

TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.3-tuxcare.11.

Record
CLSA-2026-1792232953
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
@nuxt/vite-builder
npm
 3.8.1 up to 3.15.3
3.15.3
nuxt
TuxCare:npm
 3.12.4-tuxcare.0 up to 3.12.4-tuxcare.3, plus listed versions
3.12.43.12.4-tuxcare.2
3.12.4-tuxcare.3
@nuxt/kit
TuxCare:npm
 3.12.4-tuxcare.0 up to 3.12.4-tuxcare.3, plus listed versions
3.12.43.12.4-tuxcare.2
3.12.4-tuxcare.3
@nuxt/schema
TuxCare:npm
 3.12.4-tuxcare.0 up to 3.12.4-tuxcare.3, plus listed versions
3.12.43.12.4-tuxcare.2
3.12.4-tuxcare.3
@nuxt/vite-builder
TuxCare:npm
 3.12.4-tuxcare.0 up to 3.12.4-tuxcare.3, plus listed versions
3.12.43.12.4-tuxcare.2
3.12.4-tuxcare.3
@nuxt/webpack-builder
TuxCare:npm
 3.12.4-tuxcare.0 up to 3.12.4-tuxcare.3, plus listed versions
3.12.43.12.4-tuxcare.2
3.12.4-tuxcare.3
nuxt
TuxCare:npm
 3.12.3-tuxcare.0 up to 3.12.3-tuxcare.11, plus listed versions
3.12.33.12.3-tuxcare.13.12.3-tuxcare.103.12.3-tuxcare.23.12.3-tuxcare.3
Show 6 moreShow less
3.12.3-tuxcare.43.12.3-tuxcare.53.12.3-tuxcare.63.12.3-tuxcare.73.12.3-tuxcare.83.12.3-tuxcare.9
3.12.3-tuxcare.11

History

History
RecordedChangedSources
aliases, products, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-24360 is a medium vulnerability (CVSS 5.3) in @clerk Nuxt, published January 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in @nuxt/vite-builder 3.15.3.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open