Executive brief
A vulnerability in the Nuxt development server could allow unauthorized users on the same local network to view sensitive project information. Specifically, an attacker can discover the absolute file path of the project on the developer's computer and a unique project identifier. This issue only affects developers running the Nuxt development server with network access enabled; production websites are not impacted.
Technical details
An information disclosure vulnerability exists in the Nuxt development server's Chrome DevTools workspace endpoint (`/.well-known/appspecific/com.chrome.devtools.json`). The `isLocalDevRequest` gate, intended to restrict access to local requests, relies on header-based validation (checking `Sec-Fetch-Site`, `Origin`, `Referer`, and `Host`) rather than verifying the peer's socket address. An attacker on the same local area network (LAN) can bypass this check by sending a request with a spoofed `Host: localhost` header and omitting browser-specific headers. This allows the retrieval of the `rootDir` and workspace UUID. The vulnerability is fixed in versions 4.5.1 and 3.21.10 by implementing a mandatory loopback address check at the TCP socket level.
Affected products
- Nuxt nuxt >= 4.4.7, < 4.5.1
- Nuxt nuxt >= 3.21.7, < 3.21.10
Timeline
- 2026-07-27: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched