CVE-2026-45670 Details
Description
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.6 and 4.4.6.
A vulnerability in the Nuxt development server when using the webpack or rspack builder, allowing source code to be stolen. This issue affects Nuxt versions 3.15.4 prior to 3.21.6, and 4.0.0-alpha.1 prior to 4.4.6. The vulnerability arises when the development server is bound to a non-loopback address and a malicious website is accessed on the same network. The attacker can inject a script that retrieves the source code from the dev server.
Users can upgrade to Nuxt versions 3.21.6 or 4.4.6, where this vulnerability has been patched. If an immediate upgrade is not possible, developers can bind the dev server to localhost and use SSH tunneling or a reverse proxy to enforce same-origin checks. Alternatively, they can switch to the Vite builder, which is not affected by this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g | CISA-ADP | ExploitVendor Advisory |
| https://github.com/nuxt/nuxt/pull/35051 | [email protected] | Issue Tracking |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99 | [email protected] | ExploitVendor Advisory |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt/rspack-builder | >= 3.12.2, < 3.21.5 >= 4.0.0, < 4.4.5 |
CPE
Remediation
| |
| nuxt nuxt/webpack-builder | >= 3.0.0, < 3.21.5 >= 4.0.0, < 4.4.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |