Executive brief
Nuxt's development server exposes sensitive project metadata (filesystem root path and workspace UUID) through a Chrome DevTools integration endpoint when bound to network-accessible interfaces. An unauthenticated attacker on the same local network can retrieve this information by sending a specially crafted HTTP request with a spoofed Host header, potentially enabling reconnaissance for further attacks. Production builds are unaffected, and exploitation requires the dev server to be reachable beyond localhost.
Technical details
The vulnerability is a header-based authentication bypass in Nuxt's development server Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The isLocalDevRequest gate, intended to restrict the endpoint to local clients, validates request metadata (Host header) rather than the actual connected peer address from the socket. An attacker on the same LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to bypass the check and retrieve the project's absolute filesystem root path (rootDir) and persistent per-project workspace UUID. Exploitation requires the dev server to be bound to a network-reachable interface (e.g., via nuxt dev --host) and experimental.chromeDevtoolsProjectSettings to be enabled (the default). The vulnerability is information disclosure only—no file access, modification, or code execution is possible. Production builds are unaffected because the endpoint is registered only as a development handler. Fixed in Nuxt 4.5.1 and 3.21.10 by verifying the connected TCP peer is a loopback address directly from the socket, rejecting non-loopback LAN clients regardless of headers.
Affected products
- Nuxt Nuxt >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10
Timeline
- 2026-07-27: disclosed
- 2026-08-11: advisory: Advisory published as GHSA-4jjw-pwvw-q6w3
- 2026-08-11: patched: Fixed in Nuxt 4.5.1 and 3.21.10
- 2026-08-13: other: GHSA-4jjw-pwvw-q6w3 withdrawn as duplicate of GHSA-7c4v-fwgw-9rf7