CVE-2026-56301: Nuxt arbitrary file read via unprotected vite-node IPC socket on Linux

CVE-2026-56301 · Severity: medium · CVSS 5.5 · Published 2026-06-23

Nuxt's development server on Linux creates an inter-process communication socket with world-readable permissions, allowing other users on the same machine to intercept and manipulate development requests. This could expose sensitive developer credentials and configuration files (like private SSH keys or database passwords stored in .env files) to unauthorized local users. The vulnerability only affects development environments on shared Linux systems and does not impact production deployments or single-user machines.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-56301 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56301 being exploited in the wild.
How severe is CVE-2026-56301?
Medium severity, with a CVSS score of 5.5, published 23 June 2026.
Which products and versions are affected?
nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for CVE-2026-56301?
Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56301 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-56301?
Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt (npm): upgrade to 4.4.7 or later
    npm install nuxt@4.4.7

Technical details

The vulnerability is an incorrect default permissions issue (CWE-276) in Nuxt's vite-node IPC server. On Linux with Node.js 20+, the server binds to an abstract-namespace Unix socket (\0nuxt-vite-node-<pid>-<ts>.sock) which has no filesystem inode and therefore no permission bits. Any local user with read access to /proc/net/unix can enumerate and connect to the socket without authentication. The IPC server lacks peer-credential or shared-secret validation. The 'module' request type directly passes its moduleId field to Vite's SSR fetchModule() function, which bypasses Vite's HTTP-layer server.fs.allow deny-list, enabling file read attacks. The 'resolve' request type additionally enables filesystem probing. Attack vector is local with low privilege requirements and no user interaction. The fix (nuxt@4.4.7 and nuxt@3.21.7) removes the abstract-namespace socket entirely, always binding to a filesystem-based Unix socket under the OS temp directory with explicit chmod 0600 permissions, restricting connections to the owning UID.

Affected products

  • Nuxt Nuxt >=4.0.0, <4.4.7; >=3.18.0, <3.21.7

Identifiers

  • CVE-2026-56301
  • GHSA-534h-c3cw-v3h9

Timeline

  • 2026-06-16: disclosed: GHSA-534h-c3cw-v3h9 published; CVE-2026-56301 assigned
  • 2026-06-02: patched: Fix committed in nuxt@4.4.7 (commit 1f9f4767) and backported to nuxt@3.21.7 (commit c293bf95)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.