Executive brief
Nuxt is a popular framework for building web applications in Node.js. When its development server is exposed to a local network, it can leak the absolute filesystem path and a persistent workspace identifier through an improperly secured endpoint. An attacker on the same network can retrieve this sensitive information using simple command-line tools, potentially aiding reconnaissance for further attacks or helping to identify the project structure.
Technical details
The vulnerability is an information disclosure issue (CWE-200) in Nuxt's development server Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint uses a header-based access control check (isLocalDevRequest) that trusts request metadata and the Host header rather than validating the actual TCP peer address. An attacker on the same LAN with network reachability to the dev server can bypass this check by omitting authentication headers and specifying a localhost Host header, allowing them to retrieve the absolute project root filesystem path and a persistent workspace UUID without authentication. The vulnerability affects only development builds with the feature enabled (experimental.chromeDevtoolsProjectSettings defaults to true) and does not enable file read, write, or code execution. Patches are available in Nuxt 4.5.1 and 3.21.10, which enforce loopback address validation at the socket level rather than relying on headers.
Affected products
- Nuxt Nuxt >= 3.21.7, < 3.21.10 and >= 4.4.7, < 4.5.1
Timeline
- 2026-07-27: disclosed
- 2026-08-07: patched: Patched in nuxt@4.5.1 and nuxt@3.21.10