Junglewise Threat Intelligence

CVE-2026-56301: Nuxt arbitrary file read via unprotected vite-node IPC socket on Linux

CVE-2026-56301 · Severity: medium · CVSS 5.5 · Published 2026-06-23

Vendors: Nuxt.

Executive brief

Nuxt's development server on Linux creates an inter-process communication socket with world-readable permissions, allowing other users on the same machine to intercept and manipulate development requests. This could expose sensitive developer credentials and configuration files (like private SSH keys or database passwords stored in .env files) to unauthorized local users. The vulnerability only affects development environments on shared Linux systems and does not impact production deployments or single-user machines.

Technical details

The vulnerability is an incorrect default permissions issue (CWE-276) in Nuxt's vite-node IPC server. On Linux with Node.js 20+, the server binds to an abstract-namespace Unix socket (\0nuxt-vite-node-<pid>-<ts>.sock) which has no filesystem inode and therefore no permission bits. Any local user with read access to /proc/net/unix can enumerate and connect to the socket without authentication. The IPC server lacks peer-credential or shared-secret validation. The 'module' request type directly passes its moduleId field to Vite's SSR fetchModule() function, which bypasses Vite's HTTP-layer server.fs.allow deny-list, enabling file read attacks. The 'resolve' request type additionally enables filesystem probing. Attack vector is local with low privilege requirements and no user interaction. The fix (nuxt@4.4.7 and nuxt@3.21.7) removes the abstract-namespace socket entirely, always binding to a filesystem-based Unix socket under the OS temp directory with explicit chmod 0600 permissions, restricting connections to the owning UID.

Affected products

  • Nuxt Nuxt >=4.0.0, <4.4.7; >=3.18.0, <3.21.7

Timeline

  • 2026-06-16: disclosed: GHSA-534h-c3cw-v3h9 published; CVE-2026-56301 assigned
  • 2026-06-02: patched: Fix committed in nuxt@4.4.7 (commit 1f9f4767) and backported to nuxt@3.21.7 (commit c293bf95)

References