4vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate4 (100.0%)
- Low0 (0.0%)
nuxt-vite-builder
Ecosystem: npm
Downloads: 10.2 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 4ModerateAffects 4 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 3 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 3
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting nuxt-vite-builder, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3xf4-9g3c-4h4w | Moderate | Nuxt dev server exposes generated appSecret through Vite file serving### Impact When no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a development secret and stores it in `<buildDir>/app-secret` (by default `.nuxt/app-secret`). The build directory is inside the directories that Nuxt passes to Vite's `server.fs.allow`, so the file can be fetched from the dev server: ```bash curl http://<dev-server>/_nuxt/@fs/<absolute-path-to-project>/.nuxt/app-secret ``` Anyone who can read it can compute every secret derived from it with `deriveSecret()`, including the default password used by `useS |
| GitHub (opens in a new tab) | |
| GHSA-648h-gw55-m2g7 | Moderate | Nuxt dev server exposes private runtime config through the Nitro dev bundle### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact `nuxt dev` writes the Nitro development server bundle to `<buildDir>/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is |
| GitHub (opens in a new tab) | |
| GHSA-x287-wcfc-q46c | Moderate | Nuxt dev server arbitrary file read through client error reports### Summary A client that can connect to the dev server's HMR socket can send a `nuxt:dev:client-error` event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in the report shown in the terminal. ### Impact This affects the development server only; production builds contain none of this code. Affected versions are `4.6.0` to `4.6.2`. Reading the file requires TCP access to the dev server, so the default localhost bind limits this to local processes, |
| GitHub (opens in a new tab) | |
| GHSA-2452-6xj8-jh47 | Moderate | Opening a malicious website while running a Nuxt dev server could allow read-only access to code### Summary Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. ### Details While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995). https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263 That CORS handler sets `Access-Control-Allow-Origin: *`. > [!IMPORTANT] > If on an affected version, it may be possible to o |
| GitHub (opens in a new tab) |
- GHSA-3xf4-9g3c-4h4wModerateNuxt dev server exposes generated appSecret through Vite file serving
>= 4.6.0, < 4.6.3
### Impact When no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a development secret and stores it in `<buildDir>/app-secret` (by default `.nuxt/app-secret`). The build directory is inside the directories that Nuxt passes to Vite's `server.fs.allow`, so the file can be fetched from the dev server: ```bash curl http://<dev-server>/_nuxt/@fs/<absolute-path-to-project>/.nuxt/app-secret ``` Anyone who can read it can compute every secret derived from it with `deriveSecret()`, including the default password used by `useS
CVE: CVE-2026-119201
- GHSA-648h-gw55-m2g7ModerateNuxt dev server exposes private runtime config through the Nitro dev bundle
>= 3.0.0, < 4.6.3
### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact `nuxt dev` writes the Nitro development server bundle to `<buildDir>/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is
CVE: CVE-2026-119199
- GHSA-x287-wcfc-q46cModerateNuxt dev server arbitrary file read through client error reports
>= 4.6.0, < 4.6.3
### Summary A client that can connect to the dev server's HMR socket can send a `nuxt:dev:client-error` event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in the report shown in the terminal. ### Impact This affects the development server only; production builds contain none of this code. Affected versions are `4.6.0` to `4.6.2`. Reading the file requires TCP access to the dev server, so the default localhost bind limits this to local processes,
CVE: CVE-2026-119198
- GHSA-2452-6xj8-jh47ModerateOpening a malicious website while running a Nuxt dev server could allow read-only access to code
>= 3.8.1, < 3.15.3
### Summary Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. ### Details While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by default (https://github.com/nuxt/nuxt/pull/23995). https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263 That CORS handler sets `Access-Control-Allow-Origin: *`. > [!IMPORTANT] > If on an affected version, it may be possible to o
CVE: CVE-2025-24360