Junglewise Threat Intelligence

Nuxt dev server information disclosure via Chrome DevTools endpoint

Severity: medium · CVSS 6.2 · Published 2026-08-11

Executive brief

Nuxt's development server contains an information disclosure vulnerability in its Chrome DevTools integration endpoint. When a developer runs the dev server on a network-accessible interface (common in team environments), an attacker on the same LAN can retrieve sensitive project information including the absolute filesystem path and a persistent workspace identifier, without authentication. This could enable follow-up attacks by providing attackers with critical path information and project-specific identifiers. Production builds are unaffected.

Technical details

The vulnerability is a header-based authentication bypass (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in Nuxt's development server. The GET /.well-known/appspecific/com.chrome.devtools.json endpoint performs local-request validation via the isLocalDevRequest function, which trusts the attacker-supplied Host header rather than validating the actual peer address. When the dev server is bound to a network-reachable interface (e.g., via nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can craft a request with a spoofed Host header and omit browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and persistent per-project workspace UUID. Attack requires network adjacency (LAN access) but no authentication or user interaction. The vulnerability has been fixed in Nuxt 4.5.1 and 3.21.10.

Affected products

  • Nuxt Nuxt >=4.4.7, <4.5.1; >=3.21.7, <3.21.10

Timeline

  • 2026-08-11: disclosed
  • 2026-08-11: advisory: GHSA-4jjw-pwvw-q6w3 published; later withdrawn as duplicate of GHSA-7c4v-fwgw-9rf7
  • 2026-08-13: patched: Patches released in Nuxt 4.5.1 and 3.21.10

References

Related threats