CVE-2025-24361: Nuxt webpack/rspack dev server source code disclosure via CORS

CVE-2025-24361 · Severity: low · CVSS 3.1 · Published 2025-01-27

Nuxt is a popular Vue.js framework used to build web applications. Developers running Nuxt's local development server may have their application source code exposed to attackers if they visit a malicious website while the dev server is running. The attacker can extract the application's code by requesting bundled JavaScript files from the development server, which lack proper access controls. This risk only affects development environments, not production deployments.

Technologies: @nuxt/rspack-builder (npm), @nuxt/webpack-builder (npm). Vendors: npm.

Quick answers

Is CVE-2025-24361 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-24361 being exploited in the wild.
How severe is CVE-2025-24361?
Low severity, with a CVSS score of 3.1, published 27 January 2025.
Which products and versions are affected?
@nuxt/rspack-builder (npm) SEMVER:introduced=3.12.2,fixed=3.15.3; @nuxt/webpack-builder (npm) SEMVER:introduced=3.0.0,fixed=3.15.3.
Is there a fix for CVE-2025-24361?
Yes. @nuxt/rspack-builder (npm): upgrade to 3.15.3 or later; @nuxt/webpack-builder (npm): upgrade to 3.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24361 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-24361?
Check whether you run @nuxt/rspack-builder (npm) or @nuxt/webpack-builder (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nuxt/rspack-builder (npm): upgrade to 3.15.3 or later
    npm install @nuxt/rspack-builder@3.15.3
  • @nuxt/webpack-builder (npm): upgrade to 3.15.3 or later
    npm install @nuxt/webpack-builder@3.15.3

Technical details

The vulnerability exists in @nuxt/webpack-builder (versions 3.0.0 to 3.15.3) and @nuxt/rspack-builder (versions 3.12.2 to 3.15.3) due to insufficient CORS (Cross-Origin Resource Sharing) restrictions on the development server. When a developer runs npm run dev, the server exposes bundled JavaScript at paths like /_nuxt/app.js without enforcing same-origin policy. An attacker can inject a script tag pointing to http://localhost:3000/_nuxt/app.js from a malicious website of different origin; since classic script tags bypass CORS, the bundle loads and is exposed to the attacker's code. By calling Function::toString() on webpack chunk objects (window.webpackChunknuxt_app), attackers can extract the full source code including compiled modules and sourcemaps. The attack requires user interaction (opening a malicious site) but no authentication. The fix restricts CORS access to local origins and allows configuration via devServer.cors option.

Affected products

  • Nuxt @nuxt/webpack-builder 3.0.0 to 3.15.3
  • Nuxt @nuxt/rspack-builder 3.12.2 to 3.15.3

Identifiers

  • CVE-2025-24361
  • GHSA-4gf7-ff8x-hq99

Timeline

  • 2025-01-27: disclosed: Vulnerability publicly disclosed via GitHub Security Advisory GHSA-4gf7-ff8x-hq99
  • 2025-01-27: patched: Patch available in @nuxt/webpack-builder 3.15.4+ and @nuxt/rspack-builder 3.15.4+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.