Executive brief
Nuxt's development server (nuxt dev) on Linux binds an internal communication socket without proper access controls, allowing any local user on the system to connect and read sensitive files like .env or SSH keys. This only affects developers using the development server; production builds are unaffected.
Technical details
The vulnerability is an incorrect default permissions issue (CWE-276) in Nuxt's vite-node IPC server. When running nuxt dev on Linux with Node.js 20+, the server binds to an abstract-namespace Unix socket (\\0nuxt-vite-node-<pid>-<ts>.sock) with no permission restrictions. Abstract sockets lack filesystem inodes and permission bits, making them enumerable and connectable by any local user who can read /proc/net/unix. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files through the SSR plugin pipeline by requesting paths like /home/<dev>/project/.env?raw. The fix (Nuxt 4.4.7 and 3.21.7) replaces abstract sockets with filesystem Unix sockets chmod 0600, restricting access to the owning UID. The vulnerability requires local system access and only affects development environments on multi-tenant Linux hosts.
Affected products
- Nuxt Nuxt 3.18.0 before 3.21.7, 4.0.0 before 4.4.7
Timeline
- 2026-06-23: disclosed
- 2026-06-23: patched: Patched in Nuxt 4.4.7 and 3.21.7