Executive brief
Nuxt's development server exposes an unauthenticated endpoint that discloses sensitive project information, including the absolute filesystem path (often revealing username) and a persistent project UUID. The issue affects only development servers, not production builds, but could be exploited by attackers on the same network or through DNS rebinding attacks to map out developer machines and track projects across rebuilds.
Technical details
The vulnerability is an information disclosure flaw in Nuxt's dev server. When `experimental.chromeDevtoolsProjectSettings` is enabled (the default), an unauthenticated route is registered at `/.well-known/appspecific/com.chrome.devtools.json` that returns the project root's absolute filesystem path and a persistent workspace UUID. The handler bypasses the CORS and origin validation checks used by the rest of the dev pipeline. Exploitation requires either (1) LAN-adjacent network access when the dev server is bound to a non-loopback interface, or (2) DNS rebinding to attack loopback-bound servers. The endpoint returns JSON without CORS headers, limiting remote cross-origin access. Fixed in Nuxt 4.4.7 (PR #35201) by routing the handler through the same origin gate as other dev server endpoints. Production builds are unaffected.
Affected products
- Nuxt Nuxt 4.0.0-alpha.1 through 4.4.6
Timeline
- 2026-06-15: disclosed
- 2026-04-28: patched: Fix merged in PR #35201, released in nuxt@4.4.7