Junglewise Threat Intelligence

Nuxt dev server vite-node IPC socket insufficient permissions

Severity: low · CVSS 3.1 · Published 2026-06-23

Executive brief

Nuxt's development server binds an inter-process communication (IPC) socket for handling module requests without proper access controls on Linux. Unprivileged local users on the same system can connect to this socket and read sensitive files such as .env files and SSH keys. The vulnerability only affects development mode (nuxt dev) and does not impact production builds or non-Linux systems.

Technical details

The vite-node IPC server in Nuxt 4.0.0–4.4.6 and 3.18.0–3.21.6 binds to a Linux abstract-namespace Unix socket (e.g., \0nuxt-vite-node-<pid>-<ts>.sock) without filesystem permission bits. Abstract sockets can be enumerated via /proc/net/unix by any local user and lack authentication checks. The module request handler passes moduleId directly into Vite's SSR fetchModule() function, which is not subject to Vite's HTTP-layer denial-list. A co-resident unprivileged user can request sensitive files like .env?raw or ~/.ssh/id_rsa?raw to read the developer's secrets. The fix (versions 4.4.7 and 3.21.7) replaces abstract sockets with filesystem-based Unix sockets under the OS temp directory, explicitly chmod 0600 them after binding, and fails safely if permission restriction fails. The vulnerability is CWE-276 (Incorrect Default Permissions) and requires local access on Linux with Node.js 20+ outside containerized environments.

Affected products

  • Nuxt nuxt 4.0.0 before 4.4.7, 3.18.0 before 3.21.7

Timeline

  • 2026-06-02: disclosed: Advisory GHSA-534h-c3cw-v3h9 published
  • 2026-06-02: patched: Fix committed to main branch (commit 1f9f476)
  • 2026-06-02: patched: Fix backported to v3 (commit c293bf95)
  • 2026-09-23: other: Advisory GHSA-2x6f-57hp-86fx withdrawn as duplicate of GHSA-534h-c3cw-v3h9

References

Related threats