{"id":"CVE-2026-49993","aliases":["CLSA-2026-1792160954","CLSA-2026-1792161483","CLSA-2026-1792161588","CLSA-2026-1792161924","CLSA-2026-1792758402","CLSA-2026-1792758690","CLSA-2026-1792758921","CLSA-2026-1793661076","EUVD-2026-36421","GHSA-rq7w-g337-39qq","GHSA-x6qj-4h56-5rj5"],"status":"published","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","description":"Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.","severity":{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0028,"percentile":0.20708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-749"],"published":"2026-06-12T12:57:43Z","modified":"2026-11-10T19:58:27Z","fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.4.7"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@nuxt/webpack-builder","fixed_in":["4.4.7","3.21.7"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@nuxt/rspack-builder","fixed_in":["4.4.7","3.21.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.4"},{"fixed":"3.21.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.15.4"},{"fixed":"3.21.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/rspack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.3-tuxcare.0"},{"fixed":"4.0.3-tuxcare.4"}]}],"versions":["4.0.3","4.0.3-tuxcare.1","4.0.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.16"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.12","3.12.4-tuxcare.13","3.12.4-tuxcare.14","3.12.4-tuxcare.15","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.12"}]}],"versions":["3.12.3","3.12.3-tuxcare.1","3.12.3-tuxcare.10","3.12.3-tuxcare.11","3.12.3-tuxcare.2","3.12.3-tuxcare.3","3.12.3-tuxcare.4","3.12.3-tuxcare.5","3.12.3-tuxcare.6","3.12.3-tuxcare.7","3.12.3-tuxcare.8","3.12.3-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.8"}]}],"versions":["3.2.0","3.2.0-tuxcare.1","3.2.0-tuxcare.2","3.2.0-tuxcare.3","3.2.0-tuxcare.4","3.2.0-tuxcare.5","3.2.0-tuxcare.6","3.2.0-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.8"}]}],"versions":["3.2.0","3.2.0-tuxcare.2","3.2.0-tuxcare.4","3.2.0-tuxcare.5","3.2.0-tuxcare.6","3.2.0-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0-alpha.1"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@nuxt/webpack-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@nuxt/webpack-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"3.15.4"},{"fixed":"3.21.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@nuxt/rspack-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.4.7"}]}]},{"source":"osv","ecosystem":"npm","package":"@nuxt/rspack-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"3.15.4"},{"fixed":"3.21.7"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"},{"vendor":"nuxt","product":"nuxt\\/rspack-builder"},{"vendor":"nuxt","product":"nuxt\\/webpack-builder"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g","tags":["x_refsource_MISC","exploit","Exploit","Mitigation","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/pull/35200","tags":["x_refsource_MISC","Issue Tracking","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-rq7w-g337-39qq","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/pull/35201","tags":["web"]},{"url":"https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rq7w-g337-39qq"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49993","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6qj-4h56-5rj5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49993.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-49993","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","description":"Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T12:57:43.232Z","modified":"2026-06-12T13:42:21.829Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-36421","description":"Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T12:57:43Z","modified":"2026-06-12T13:42:21Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:43.577088Z"}],"ghsa":[{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T20:56:23Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:28.438722Z"},{"id":"GHSA-x6qj-4h56-5rj5","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","description":"### Summary\nThis is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g). Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network.\n\n### Details\nThe fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) added an `Origin` / `Referer` fallback to the dev-middleware same-origin check, with a `return true` branch when neither header is present so that non-browser clients (curl, the HMR client, address-bar navigation) keep working.\n\nThat fallback is bypassed when a cross-origin attacker request reaches the dev server with all three signal headers absent:\n\n- `Sec-Fetch-Site` is [not sent by browsers to non-potentially-trustworthy destinations](https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-site-header) (HTTP on a non-loopback address).\n- `Origin` is not sent on non-CORS subresource fetches (a bare `\u003cscript\u003e` with no `crossorigin`).\n- `Referer` can be suppressed by the attacker page with `\u003cmeta name=\"referrer\" content=\"no-referrer\"\u003e` or `referrerpolicy=\"no-referrer\"` on the `\u003cscript\u003e` element.\n\nA classic `\u003cscript src=\"http://VICTIM_LAN_IP:3000/_nuxt/app.js\" referrerpolicy=\"no-referrer\"\u003e` from a non-trustworthy attacker origin produces exactly that header set, the request is allowed, and the attacker page can read the built source out of `window.webpackChunk*` via `Function.prototype.toString()`.\n\nSince the attack requires the dev server to be reachable via a non-potentially-trustworthy origin, only apps using `--host` (or `--host 0.0.0.0`) are affected. Chrome 142+ users are also protected by [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n\n### PoC\n1. Create a Nuxt project with the webpack / rspack builder.\n1. Run `npm run dev -- --host 0.0.0.0`.\n1. Open `http://localhost:3000` on the developer machine.\n1. From a different LAN host, serve the page below and open it in the same browser.\n1. The compiled module source is exfiltrable from `window.webpackChunknuxt_\u003cprojectname\u003e`.\n\n```html\n\u003c!doctype html\u003e\n\u003cmeta name=\"referrer\" content=\"no-referrer\"\u003e\n\u003cscript\u003e\n  ['/_nuxt/runtime.js', '/_nuxt/app.js'].forEach(p =\u003e {\n    const s = document.createElement('script')\n    s.src = 'http://VICTIM_LAN_IP:3000' + p\n    s.referrerPolicy = 'no-referrer'\n    document.head.appendChild(s)\n  })\n  setTimeout(() =\u003e {\n    const key = Object.keys(window).find(k =\u003e k.startsWith('webpackChunk'))\n    for (const [, mods] of window[key]) {\n      for (const id in mods) {\n        console.log(id, mods[id].toString())\n      }\n    }\n  }, 1500)\n\u003c/script\u003e\n```\n\n### Impact\nUsers using the webpack / rspack builder with `nuxt dev --host` may get the built source code read by malicious websites on the same network, including module identifiers, the developer's local filesystem path, and any developer-controlled strings inlined into the bundle.\n\nThis vulnerability does not affect Chrome 142+ (and other Chromium-based browsers) users due to [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n\nThe default Vite builder is not affected.\n\n### Patches\nFixed in `@nuxt/webpack-builder@4.4.7` / `@nuxt/rspack-builder@4.4.7` and backported to `@nuxt/webpack-builder@3.21.7` / `@nuxt/rspack-builder@3.21.7` by [#35200](https://github.com/nuxt/nuxt/pull/35200) (4.x: commit [`e351de94`](https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3); 3.x: commit [`77187ee4`](https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05)). The dev-middleware same-origin check now treats a request with no `Sec-Fetch-Site`, no `Origin`, and no `Referer` as same-origin only when the dev server is loopback-bound, closing the header-suppression bypass.\n\nThe fix only ships for the `@nuxt/webpack-builder` and `@nuxt/rspack-builder` packages. The default Vite builder was not affected.\n\n### Workarounds\nIf you cannot upgrade immediately:\n\n- Don't use `nuxt dev --host`. Bind the dev server to `localhost` (the default) and tunnel from other devices via SSH or a reverse proxy that enforces same-origin checks.\n- Use Chrome 142+ or another Chromium-based browser that enforces [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n- Switch to the Vite builder for development.\n\n### Credit\nReported by Berkan SAL ([@Uhudsavasindankacanokcu2](https://github.com/Uhudsavasindankacanokcu2)) via the Vercel Open Source HackerOne program.\n\nIndependently reported by [@DavidCarliez](https://github.com/DavidCarliez) via GitHub's coordinated disclosure flow (`GHSA-xw96-2f5x-v9pv`), closed as a duplicate of this advisory.","status":"published","published":"2026-06-16T23:39:16Z","modified":"2026-06-16T23:39:18Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T14:40:28.438722Z"}],"nvd":[{"id":"CVE-2026-49993","description":"Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T14:16:32.65Z","modified":"2026-06-17T10:55:49.903Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"CVE-2026-49993","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","description":"Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.","status":"published","published":"2026-06-12T12:57:43.232Z","modified":"2026-10-28T02:31:15.005290125Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-rq7w-g337-39qq","title":"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`","description":"### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has no host / origin / `Sec-Fetch-Site` check of its own.\n\n### Impact\n\nDev-server only. Production builds do not register the route.\n\nTwo values are disclosed:\n\n- `workspace.root`: the absolute filesystem path of the project (commonly reveals the OS username and the on-disk project name).\n- `workspace.uuid`: a v4 UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`, stable across dev-server restarts and re-clones.\n\n### Threat model\n\nThe response carries no `Access-Control-Allow-Origin` header. A cross-origin `fetch()` from an arbitrary malicious page is therefore blocked by the browser's same-origin policy and cannot read the body. The two realistic recovery paths are:\n\n1. **LAN-adjacent attacker** when the developer runs `nuxt dev --host` (or otherwise binds to a non-loopback interface). A plain `curl http://\u003cdev-lan-ip\u003e:3000/.well-known/appspecific/com.chrome.devtools.json` returns the JSON; no browser, no CORS.\n2. **DNS rebinding** against the default loopback dev server. A page the developer visits resolves to the attacker, then re-resolves to `127.0.0.1` after the TTL; the browser believes the request is same-origin and reads the response.\n\n### Affected versions\n\n`nuxt@4.0.0-alpha.1` (PR #32084) through `nuxt@4.4.6`. `3.x` is not affected.\n\n### Reproduction\n\n```bash\nnpx nuxt dev\ncurl -s http://localhost:3000/.well-known/appspecific/com.chrome.devtools.json\n# {\"workspace\":{\"uuid\":\"...\",\"root\":\"/Users/\u003cname\u003e/...\"}}\n```\n\n### Workaround\n\nSet `experimental: { chromeDevtoolsProjectSettings: false }` in `nuxt.config.ts`. Chrome DevTools' Workspace auto-integration will stop working; the dev server is otherwise unaffected.\n\n### Patches\n\nFixed in `nuxt@4.4.7` by [#35201](https://github.com/nuxt/nuxt/pull/35201) (commit [`55c75b78`](https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15)). The handler is now routed through the same host / origin gate the rest of the dev server uses, so the endpoint only responds to requests that look local.","status":"published","published":"2026-06-15T20:56:22Z","modified":"2026-06-15T21:00:07.676162148Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"GHSA-x6qj-4h56-5rj5","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","description":"### Summary\nThis is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g). Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network.\n\n### Details\nThe fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) added an `Origin` / `Referer` fallback to the dev-middleware same-origin check, with a `return true` branch when neither header is present so that non-browser clients (curl, the HMR client, address-bar navigation) keep working.\n\nThat fallback is bypassed when a cross-origin attacker request reaches the dev server with all three signal headers absent:\n\n- `Sec-Fetch-Site` is [not sent by browsers to non-potentially-trustworthy destinations](https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-site-header) (HTTP on a non-loopback address).\n- `Origin` is not sent on non-CORS subresource fetches (a bare `\u003cscript\u003e` with no `crossorigin`).\n- `Referer` can be suppressed by the attacker page with `\u003cmeta name=\"referrer\" content=\"no-referrer\"\u003e` or `referrerpolicy=\"no-referrer\"` on the `\u003cscript\u003e` element.\n\nA classic `\u003cscript src=\"http://VICTIM_LAN_IP:3000/_nuxt/app.js\" referrerpolicy=\"no-referrer\"\u003e` from a non-trustworthy attacker origin produces exactly that header set, the request is allowed, and the attacker page can read the built source out of `window.webpackChunk*` via `Function.prototype.toString()`.\n\nSince the attack requires the dev server to be reachable via a non-potentially-trustworthy origin, only apps using `--host` (or `--host 0.0.0.0`) are affected. Chrome 142+ users are also protected by [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n\n### PoC\n1. Create a Nuxt project with the webpack / rspack builder.\n1. Run `npm run dev -- --host 0.0.0.0`.\n1. Open `http://localhost:3000` on the developer machine.\n1. From a different LAN host, serve the page below and open it in the same browser.\n1. The compiled module source is exfiltrable from `window.webpackChunknuxt_\u003cprojectname\u003e`.\n\n```html\n\u003c!doctype html\u003e\n\u003cmeta name=\"referrer\" content=\"no-referrer\"\u003e\n\u003cscript\u003e\n  ['/_nuxt/runtime.js', '/_nuxt/app.js'].forEach(p =\u003e {\n    const s = document.createElement('script')\n    s.src = 'http://VICTIM_LAN_IP:3000' + p\n    s.referrerPolicy = 'no-referrer'\n    document.head.appendChild(s)\n  })\n  setTimeout(() =\u003e {\n    const key = Object.keys(window).find(k =\u003e k.startsWith('webpackChunk'))\n    for (const [, mods] of window[key]) {\n      for (const id in mods) {\n        console.log(id, mods[id].toString())\n      }\n    }\n  }, 1500)\n\u003c/script\u003e\n```\n\n### Impact\nUsers using the webpack / rspack builder with `nuxt dev --host` may get the built source code read by malicious websites on the same network, including module identifiers, the developer's local filesystem path, and any developer-controlled strings inlined into the bundle.\n\nThis vulnerability does not affect Chrome 142+ (and other Chromium-based browsers) users due to [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n\nThe default Vite builder is not affected.\n\n### Patches\nFixed in `@nuxt/webpack-builder@4.4.7` / `@nuxt/rspack-builder@4.4.7` and backported to `@nuxt/webpack-builder@3.21.7` / `@nuxt/rspack-builder@3.21.7` by [#35200](https://github.com/nuxt/nuxt/pull/35200) (4.x: commit [`e351de94`](https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3); 3.x: commit [`77187ee4`](https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05)). The dev-middleware same-origin check now treats a request with no `Sec-Fetch-Site`, no `Origin`, and no `Referer` as same-origin only when the dev server is loopback-bound, closing the header-suppression bypass.\n\nThe fix only ships for the `@nuxt/webpack-builder` and `@nuxt/rspack-builder` packages. The default Vite builder was not affected.\n\n### Workarounds\nIf you cannot upgrade immediately:\n\n- Don't use `nuxt dev --host`. Bind the dev server to `localhost` (the default) and tunnel from other devices via SSH or a reverse proxy that enforces same-origin checks.\n- Use Chrome 142+ or another Chromium-based browser that enforces [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n- Switch to the Vite builder for development.\n\n### Credit\nReported by Berkan SAL ([@Uhudsavasindankacanokcu2](https://github.com/Uhudsavasindankacanokcu2)) via the Vercel Open Source HackerOne program.\n\nIndependently reported by [@DavidCarliez](https://github.com/DavidCarliez) via GitHub's coordinated disclosure flow (`GHSA-xw96-2f5x-v9pv`), closed as a duplicate of this advisory.","status":"published","published":"2026-06-16T23:39:16Z","modified":"2026-09-10T03:50:12.300274004Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-749"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"CLSA-2026-1792160954","title":"TuxCare security update for @nuxt/vite-builder (2 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:29:10Z","modified":"2026-11-10T19:45:14.295679752Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161483","title":"TuxCare security update for @nuxt/rspack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/rspack-builder to address 4 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:38:03Z","modified":"2026-11-10T19:45:16.370820957Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161588","title":"TuxCare security update for @nuxt/schema (2 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 2 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:39:48Z","modified":"2026-11-10T19:45:15.106359209Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161924","title":"TuxCare security update for @nuxt/webpack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 4 CVEs. Fixed in 4.0.3-tuxcare.4.","status":"published","published":"2026-10-16T14:45:24Z","modified":"2026-11-10T19:58:27.113110658Z","updated_at":"2026-11-10T20:07:20.748062Z"},{"id":"CLSA-2026-1792758402","title":"TuxCare security update for nuxt (3 CVEs)","description":"TuxCare rebuilt nuxt to address 3 CVEs. Fixed in 3.12.4-tuxcare.16.","status":"published","published":"2026-10-23T12:26:42Z","modified":"2026-10-23T13:45:35.535803667Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792758690","title":"TuxCare security update for nuxt (3 CVEs)","description":"TuxCare rebuilt nuxt to address 3 CVEs. Fixed in 3.12.3-tuxcare.12.","status":"published","published":"2026-10-23T12:31:30Z","modified":"2026-10-23T13:45:35.083475944Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792758921","title":"TuxCare security update for nuxt (3 CVEs)","description":"TuxCare rebuilt nuxt to address 3 CVEs. Fixed in 3.2.0-tuxcare.8.","status":"published","published":"2026-10-23T12:35:21Z","modified":"2026-11-03T02:45:02.428500719Z","updated_at":"2026-11-03T03:05:43.703218Z"},{"id":"CLSA-2026-1793661076","title":"TuxCare security update for nuxi (3 CVEs)","description":"TuxCare rebuilt nuxi to address 3 CVEs. Fixed in 3.2.0-tuxcare.8.","status":"published","published":"2026-11-03T00:11:16Z","modified":"2026-11-03T02:45:02.364797503Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}