Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 23 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

Is there a fix for This vulnerability?

Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nuxt dev server vite-node IPC socket insufficient permissions

Severity: low · CVSS 3.1 · Published 2026-06-23

Nuxt's development server binds an inter-process communication (IPC) socket for handling module requests without proper access controls on Linux. Unprivileged local users on the same system can connect to this socket and read sensitive files such as .env files and SSH keys. The vulnerability only affects development mode (nuxt dev) and does not impact production builds or non-Linux systems.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 23 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for This vulnerability?: Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.7 or later
```
npm install nuxt@4.4.7
```

Technical details

The vite-node IPC server in Nuxt 4.0.0–4.4.6 and 3.18.0–3.21.6 binds to a Linux abstract-namespace Unix socket (e.g., \0nuxt-vite-node-<pid>-<ts>.sock) without filesystem permission bits. Abstract sockets can be enumerated via /proc/net/unix by any local user and lack authentication checks. The module request handler passes moduleId directly into Vite's SSR fetchModule() function, which is not subject to Vite's HTTP-layer denial-list. A co-resident unprivileged user can request sensitive files like .env?raw or ~/.ssh/id_rsa?raw to read the developer's secrets. The fix (versions 4.4.7 and 3.21.7) replaces abstract sockets with filesystem-based Unix sockets under the OS temp directory, explicitly chmod 0600 them after binding, and fails safely if permission restriction fails. The vulnerability is CWE-276 (Incorrect Default Permissions) and requires local access on Linux with Node.js 20+ outside containerized environments.

Affected products

Nuxt nuxt 4.0.0 before 4.4.7, 3.18.0 before 3.21.7

Timeline

2026-06-02: disclosed: Advisory GHSA-534h-c3cw-v3h9 published
2026-06-02: patched: Fix committed to main branch (commit 1f9f476)
2026-06-02: patched: Fix backported to v3 (commit c293bf95)
2026-09-23: other: Advisory GHSA-2x6f-57hp-86fx withdrawn as duplicate of GHSA-534h-c3cw-v3h9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.