Is CVE-2026-119201 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119201 being exploited in the wild.

How severe is CVE-2026-119201?

Medium severity, with a CVSS score of 4.8, published 29 October 2026.

Which products and versions are affected?

@nuxt/vite-builder (npm) >= 4.6.0, < 4.6.3, SEMVER:introduced=4.6.0,fixed=4.6.3; Nuxt 4.6.0 to 4.6.2.

Is there a fix for CVE-2026-119201?

Yes. @nuxt/vite-builder (npm): upgrade to 4.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119201 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119201?

Check whether you run @nuxt/vite-builder (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119201: Nuxt information disclosure in development server appSecret

Q: Is there a fix for CVE-2026-119201?

Yes. @nuxt/vite-builder (npm): upgrade to 4.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-119201 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-119201?

Check whether you run @nuxt/vite-builder (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119201 · Severity: medium · CVSS 4.8 · Published 2026-10-29

Nuxt, a web development framework for Vue.js, stores a session signing secret in an accessible file during development. An attacker with access to the development server can retrieve this secret and forge session cookies, potentially gaining unauthorized account access. The vulnerability only affects development servers running versions 4.6.0 to 4.6.2 with default configuration; production builds are unaffected.

Technologies: @nuxt/vite-builder (npm), Nuxt. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-119201 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119201 being exploited in the wild.
How severe is CVE-2026-119201?: Medium severity, with a CVSS score of 4.8, published 29 October 2026.
Which products and versions are affected?: @nuxt/vite-builder (npm) >= 4.6.0, < 4.6.3, SEMVER:introduced=4.6.0,fixed=4.6.3; Nuxt 4.6.0 to 4.6.2.
Is there a fix for CVE-2026-119201?: Yes. @nuxt/vite-builder (npm): upgrade to 4.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119201 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119201?: Check whether you run @nuxt/vite-builder (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxt/vite-builder (npm): upgrade to 4.6.3 or later
```
npm install @nuxt/vite-builder@4.6.3
```

Technical details

The appSecret, used to derive session signing keys, is stored in .nuxt/app-secret within Vite's served directories during development. An attacker with network access to the dev server can fetch this file via HTTP, then use deriveSecret() to compute session passwords and forge valid cookies. The vulnerability requires network access to an exposed development server; localhost binding and CORS protections limit practical exposure.

Affected products

Nuxt Nuxt 4.6.0 to 4.6.2

Identifiers

CVE-2026-119201
GHSA-3xf4-9g3c-4h4w

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.