Executive brief
When using the Nuxt development server, a publicly accessible web address is created that reveals the exact location of the project files on the developer's computer. This information, which often includes the computer's username, could be used by attackers on the same network to map out a developer's system. This issue only affects the development environment and does not impact live production websites.
Technical details
Nuxt versions 4.0.0-alpha.1 through 4.4.6 register an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` during development. This endpoint, intended for Chrome DevTools Workspace integration, returns the absolute filesystem path of the project root and a persistent UUID. The handler is registered directly on `nitro.options.devHandlers` and bypasses the standard CORS and origin checks used by the rest of the dev pipeline. An attacker on the same local network or one utilizing DNS rebinding can access this JSON data to gain information about the developer's environment. The issue is fixed in version 4.4.7 by routing the handler through the standard host/origin security gates.
Affected products
- Nuxt Nuxt >= 4.0.0-alpha.1, < 4.4.7
Timeline
- 2026-06-02: disclosed
- 2026-06-15: advisory: GitHub Advisory published
- 2026-06-15: patched: Fixed in version 4.4.7