Executive brief
A security flaw in the Nuxt development server allows malicious websites to steal a developer's source code if the server is configured to be accessible over a local network. This could expose sensitive information such as local file paths, internal logic, and hardcoded strings. The risk is highest when developers share their development server with other devices on the same network using the --host flag.
Technical details
The Nuxt dev-middleware same-origin check contains a logic flaw where it defaults to allowing requests if the 'Sec-Fetch-Site', 'Origin', and 'Referer' headers are all missing. An attacker can exploit this by inducing a developer to visit a malicious site that triggers a subresource fetch (e.g., via a script tag) while suppressing the Referer header. Because browsers do not send 'Sec-Fetch-Site' to non-trustworthy (HTTP) LAN destinations and 'Origin' is omitted for non-CORS script fetches, the dev server incorrectly identifies the cross-origin request as same-origin. This allows the attacker to exfiltrate the built source code from the webpack/rspack chunks. The vulnerability is fixed in versions 3.21.7 and 4.4.7 by restricting this 'allow-missing-headers' behavior to loopback-bound servers only.
Affected products
- Nuxt @nuxt/webpack-builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7
- Nuxt @nuxt/rspack-builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7
Timeline
- 2026-06-02: disclosed: Initial publication in nuxt/nuxt repository
- 2026-06-12: advisory: NVD publication date
- 2026-06-16: patched: Final advisory update and backport confirmation
References
- https://api.github.com/users/Uhudsavasindankacanokcu2
- https://github.com/Uhudsavasindankacanokcu2
- https://api.github.com/users/Uhudsavasindankacanokcu2/gists%7B/gist_id%7D
- https://api.github.com/users/Uhudsavasindankacanokcu2/repos
- https://avatars.githubusercontent.com/u/71898880?v=4
- https://api.github.com/users/Uhudsavasindankacanokcu2/events%7B/privacy%7D