CVE-2026-49993: Nuxt source code disclosure in webpack and rspack builders

CVE-2026-49993 · Severity: medium · CVSS 4 · Published 2026-06-12

A security flaw in the Nuxt development server allows malicious websites to steal a developer's source code if the server is configured to be accessible over a local network. This could expose sensitive information such as local file paths, internal logic, and hardcoded strings. The risk is highest when developers share their development server with other devices on the same network using the --host flag.

Technologies: @nuxt/rspack-builder (npm), @nuxt/webpack-builder (npm), Nuxt Rspack Builder, Nuxt Webpack Builder. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-49993 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49993 being exploited in the wild.
How severe is CVE-2026-49993?
Medium severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?
@nuxt/rspack-builder (npm) SEMVER:introduced=4.0.0,fixed=4.4.7; @nuxt/webpack-builder (npm) SEMVER:introduced=4.0.0,fixed=4.4.7; Nuxt Rspack Builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7, 3.15.4 to < 3.21.7, 4.0.0 to < 4.4.7; Nuxt Webpack Builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7, 3.15.4 to < 3.21.7, 4.0.0 to < 4.4.7.
Is there a fix for CVE-2026-49993?
Yes. @nuxt/rspack-builder (npm): upgrade to 4.4.7 or later; @nuxt/webpack-builder (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49993 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-49993?
Check whether you run @nuxt/rspack-builder (npm), @nuxt/webpack-builder (npm), Nuxt Rspack Builder or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @nuxt/rspack-builder (npm): upgrade to 4.4.7 or later
    npm install @nuxt/rspack-builder@4.4.7
  • @nuxt/webpack-builder (npm): upgrade to 4.4.7 or later
    npm install @nuxt/webpack-builder@4.4.7

Technical details

The Nuxt dev-middleware same-origin check contains a logic flaw where it defaults to allowing requests if the 'Sec-Fetch-Site', 'Origin', and 'Referer' headers are all missing. An attacker can exploit this by inducing a developer to visit a malicious site that triggers a subresource fetch (e.g., via a script tag) while suppressing the Referer header. Because browsers do not send 'Sec-Fetch-Site' to non-trustworthy (HTTP) LAN destinations and 'Origin' is omitted for non-CORS script fetches, the dev server incorrectly identifies the cross-origin request as same-origin. This allows the attacker to exfiltrate the built source code from the webpack/rspack chunks. The vulnerability is fixed in versions 3.21.7 and 4.4.7 by restricting this 'allow-missing-headers' behavior to loopback-bound servers only.

Affected products

  • Nuxt @nuxt/webpack-builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7
  • Nuxt @nuxt/rspack-builder >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7

Identifiers

  • CVE-2026-49993
  • GHSA-x6qj-4h56-5rj5

Timeline

  • 2026-06-02: disclosed: Initial publication in nuxt/nuxt repository
  • 2026-06-12: advisory: NVD publication date
  • 2026-06-16: patched: Final advisory update and backport confirmation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.