CVE-2026-72744: Nuxt dev server information disclosure via Chrome DevTools endpoint

CVE-2026-72744 · Severity: medium · CVSS 6.2 · Published 2026-08-11

Nuxt is a popular framework for building web applications in Node.js. When its development server is exposed to a local network, it can leak the absolute filesystem path and a persistent workspace identifier through an improperly secured endpoint. An attacker on the same network can retrieve this sensitive information using simple command-line tools, potentially aiding reconnaissance for further attacks or helping to identify the project structure.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-72744 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72744 being exploited in the wild.
How severe is CVE-2026-72744?
Medium severity, with a CVSS score of 6.2, published 11 August 2026.
Which products and versions are affected?
nuxt (npm) SEMVER:introduced=4.4.7,fixed=4.5.1.
Is there a fix for CVE-2026-72744?
Yes. nuxt (npm): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72744 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-72744?
Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt (npm): upgrade to 4.5.1 or later
    npm install nuxt@4.5.1

Technical details

The vulnerability is an information disclosure issue (CWE-200) in Nuxt's development server Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint uses a header-based access control check (isLocalDevRequest) that trusts request metadata and the Host header rather than validating the actual TCP peer address. An attacker on the same LAN with network reachability to the dev server can bypass this check by omitting authentication headers and specifying a localhost Host header, allowing them to retrieve the absolute project root filesystem path and a persistent workspace UUID without authentication. The vulnerability affects only development builds with the feature enabled (experimental.chromeDevtoolsProjectSettings defaults to true) and does not enable file read, write, or code execution. Patches are available in Nuxt 4.5.1 and 3.21.10, which enforce loopback address validation at the socket level rather than relying on headers.

Affected products

  • Nuxt Nuxt >= 3.21.7, < 3.21.10 and >= 4.4.7, < 4.5.1

Identifiers

  • CVE-2026-72744
  • GHSA-7c4v-fwgw-9rf7

Timeline

  • 2026-07-27: disclosed
  • 2026-08-07: patched: Patched in nuxt@4.5.1 and nuxt@3.21.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.