Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.2, published 11 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-08-13: Patches released in Nuxt 4.5.1 and 3.21.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked from the adjacent network, in a web application.

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nuxt dev server information disclosure via Chrome DevTools endpoint

Severity: medium · CVSS 6.2 · Published 2026-08-11

Nuxt's development server contains an information disclosure vulnerability in its Chrome DevTools integration endpoint. When a developer runs the dev server on a network-accessible interface (common in team environments), an attacker on the same LAN can retrieve sensitive project information including the absolute filesystem path and a persistent workspace identifier, without authentication. This could enable follow-up attacks by providing attackers with critical path information and project-specific identifiers. Production builds are unaffected.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.2, published 11 August 2026.
Which products and versions are affected?: nuxt (npm) >= 4.4.7, < 4.5.1.
Is there a fix for This vulnerability?: A patch was published on 2026-08-13: Patches released in Nuxt 4.5.1 and 3.21.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked from the adjacent network, in a web application.
Am I affected?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a header-based authentication bypass (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in Nuxt's development server. The GET /.well-known/appspecific/com.chrome.devtools.json endpoint performs local-request validation via the isLocalDevRequest function, which trusts the attacker-supplied Host header rather than validating the actual peer address. When the dev server is bound to a network-reachable interface (e.g., via nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can craft a request with a spoofed Host header and omit browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and persistent per-project workspace UUID. Attack requires network adjacency (LAN access) but no authentication or user interaction. The vulnerability has been fixed in Nuxt 4.5.1 and 3.21.10.

Affected products

Nuxt Nuxt >=4.4.7, <4.5.1; >=3.21.7, <3.21.10

Timeline

2026-08-11: disclosed
2026-08-11: advisory: GHSA-4jjw-pwvw-q6w3 published; later withdrawn as duplicate of GHSA-7c4v-fwgw-9rf7
2026-08-13: patched: Patches released in Nuxt 4.5.1 and 3.21.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.