# CVE-2026-119198: Nuxt arbitrary file read in development server HMR

Source: https://junglewise.ai/threats/cve-2026-119198-nuxt-is-an-open-source-web-development-framework-for-vue-js-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-119198 · Severity: medium · CVSS 5.9 · Published 2026-10-29

Nuxt is a web framework for building Vue.js applications. A vulnerability in Nuxt's development server allows an attacker with network access to read arbitrary files from the server by sending a crafted message over the HMR (Hot Module Replacement) socket. This could expose sensitive source code, configuration files, or other data stored on the development machine.

Technologies: [@nuxt/vite-builder (npm)](https://junglewise.ai/threats/technologies/nuxt-vite-builder), [Nuxt](https://junglewise.ai/threats/technologies/nuxt-nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2026-119198 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119198 being exploited in the wild.

**How severe is CVE-2026-119198?** Medium severity, with a CVSS score of 5.9, published 29 October 2026.

**Which products and versions are affected?** @nuxt/vite-builder (npm) >= 4.6.0, < 4.6.3, SEMVER:introduced=4.6.0,fixed=4.6.3; Nuxt 4.6.0 to 4.6.2.

**Is there a fix for CVE-2026-119198?** Yes. @nuxt/vite-builder (npm): upgrade to 4.6.3 or later. Until then: Restrict network access to the Nuxt development server by only binding to localhost (the default configuration). Do not expose the development server to untrusted networks or the public internet. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119198 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-119198?** Check whether you run @nuxt/vite-builder (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nuxt/vite-builder (npm): upgrade to 4.6.3 or later

  ```sh
  npm install @nuxt/vite-builder@4.6.3
  ```


Restrict network access to the Nuxt development server by only binding to localhost (the default configuration). Do not expose the development server to untrusted networks or the public internet.

## Technical details

The vulnerability exists in Nuxt's dev error reporting mechanism, which processes client-controlled error messages and stack traces without proper validation. An attacker can send a nuxt:dev:client-error event containing an absolute file path, which the development server reads and includes in the error report, bypassing Vite's filesystem allow list. This affects versions 4.6.0 through 4.6.2; the attack requires TCP access to the development server socket and no browser interaction.

## Affected products

- Nuxt Nuxt 4.6.0 to 4.6.2

## Identifiers

- CVE-2026-119198
- GHSA-x287-wcfc-q46c

## Timeline

- 2026-10-29: disclosed

## References

- [https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3](https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3)
- [https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8](https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8)

## Related threats

- [Nuxt information disclosure in development server appSecret](https://junglewise.ai/threats/cve-2026-119201-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt development server secrets exposure in bundled configuration](https://junglewise.ai/threats/cve-2026-119199-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt case-sensitive route matching bypass](https://junglewise.ai/threats/cve-2026-114132-nuxt-is-an-open-source-web-development-framework-for-vue-js)