Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 15 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0-alpha.1,fixed=4.4.7.

Is there a fix for This vulnerability?

Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked from the adjacent network or over the network.

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nuxt dev server information disclosure via Chrome DevTools endpoint

Severity: medium · CVSS 4 · Published 2026-06-15

Nuxt's development server exposes an unauthenticated endpoint that discloses sensitive project information, including the absolute filesystem path (often revealing username) and a persistent project UUID. The issue affects only development servers, not production builds, but could be exploited by attackers on the same network or through DNS rebinding attacks to map out developer machines and track projects across rebuilds.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 15 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0-alpha.1,fixed=4.4.7.
Is there a fix for This vulnerability?: Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked from the adjacent network or over the network.
Am I affected?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.7 or later
```
npm install nuxt@4.4.7
```

Technical details

The vulnerability is an information disclosure flaw in Nuxt's dev server. When `experimental.chromeDevtoolsProjectSettings` is enabled (the default), an unauthenticated route is registered at `/.well-known/appspecific/com.chrome.devtools.json` that returns the project root's absolute filesystem path and a persistent workspace UUID. The handler bypasses the CORS and origin validation checks used by the rest of the dev pipeline. Exploitation requires either (1) LAN-adjacent network access when the dev server is bound to a non-loopback interface, or (2) DNS rebinding to attack loopback-bound servers. The endpoint returns JSON without CORS headers, limiting remote cross-origin access. Fixed in Nuxt 4.4.7 (PR #35201) by routing the handler through the same origin gate as other dev server endpoints. Production builds are unaffected.

Affected products

Nuxt Nuxt 4.0.0-alpha.1 through 4.4.6

Timeline

2026-06-15: disclosed
2026-04-28: patched: Fix merged in PR #35201, released in nuxt@4.4.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.