# Nuxt dev server vite-node IPC socket insufficient permissions

Source: https://junglewise.ai/threats/nuxt-dev-server-vite-node-ipc-socket-insufficient-permissions-762f9181  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3.1 · Published 2026-06-23

Nuxt's development server binds an inter-process communication (IPC) socket for handling module requests without proper access controls on Linux. Unprivileged local users on the same system can connect to this socket and read sensitive files such as .env files and SSH keys. The vulnerability only affects development mode (nuxt dev) and does not impact production builds or non-Linux systems.

Technologies: [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3.1, published 23 June 2026.

**Which products and versions are affected?** nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

**Is there a fix for This vulnerability?** Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked with local access, in a software library.

**Am I affected?** Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nuxt (npm): upgrade to 4.4.7 or later

  ```sh
  npm install nuxt@4.4.7
  ```


## Technical details

The vite-node IPC server in Nuxt 4.0.0–4.4.6 and 3.18.0–3.21.6 binds to a Linux abstract-namespace Unix socket (e.g., \0nuxt-vite-node-<pid>-<ts>.sock) without filesystem permission bits. Abstract sockets can be enumerated via /proc/net/unix by any local user and lack authentication checks. The module request handler passes moduleId directly into Vite's SSR fetchModule() function, which is not subject to Vite's HTTP-layer denial-list. A co-resident unprivileged user can request sensitive files like .env?raw or ~/.ssh/id_rsa?raw to read the developer's secrets. The fix (versions 4.4.7 and 3.21.7) replaces abstract sockets with filesystem-based Unix sockets under the OS temp directory, explicitly chmod 0600 them after binding, and fails safely if permission restriction fails. The vulnerability is CWE-276 (Incorrect Default Permissions) and requires local access on Linux with Node.js 20+ outside containerized environments.

## Affected products

- Nuxt nuxt 4.0.0 before 4.4.7, 3.18.0 before 3.21.7

## Timeline

- 2026-06-02: disclosed: Advisory GHSA-534h-c3cw-v3h9 published
- 2026-06-02: patched: Fix committed to main branch (commit 1f9f476)
- 2026-06-02: patched: Fix backported to v3 (commit c293bf95)
- 2026-09-23: other: Advisory GHSA-2x6f-57hp-86fx withdrawn as duplicate of GHSA-534h-c3cw-v3h9

## References

- [https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9](https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9)
- [https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5](https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5)
- [https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea](https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea)
- [https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-linux](https://www.vulncheck.com/advisories/nuxt-arbitrary-file-read-via-world-connectable-vite-node-ipc-socket-on-linux)

## Related threats

- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt case-sensitive route matching bypass](https://junglewise.ai/threats/cve-2026-114132-nuxt-is-an-open-source-web-development-framework-for-vue-js)
- [Nuxt route-rule bypass via percent-encoded segments](https://junglewise.ai/threats/cve-2026-114131-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt XSS via protocol bypass in NuxtLink](https://junglewise.ai/threats/cve-2026-114130-nuxt-is-an-open-source-web-development-framework-for-vue-js)