CVE-2026-45670 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Medium 5.9 Published 12 Jun 2026 Updated 12 Jun 2026

Attackers on the same network can steal source code from Nuxt dev servers if bound to non-loopback addresses and a malicious site is visited.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-45670?

CVE-2026-45670 is a medium-severity vulnerability in nuxt, published on 12 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.6 and 4.4.6.

Weakness: CWE-749

Which versions are affected by CVE-2026-45670?

8 open source packages ship an affected version, including @nuxt/rspack-builder and @nuxt/webpack-builder. It affects 2 products.

Package	Affected	Fixed in
`@nuxt/rspack-builder` npm	From `3.15.4`	`3.21.6`
`@nuxt/rspack-builder` npm	From `3.15.4`	`3.21.6`
`@nuxt/rspack-builder` npm	From `4.0.0-alpha.1`	`4.4.6`
`@nuxt/rspack-builder` npm	From `4.0.0-alpha.1`	`4.4.6`
`@nuxt/webpack-builder` npm	From `3.15.4`	`3.21.6`
`@nuxt/webpack-builder` npm	From `3.15.4`	`3.21.6`

2 more packages

`@nuxt/webpack-builder` npm	From `4.0.0-alpha.1`	`4.4.6`
`@nuxt/webpack-builder` npm	From `4.0.0-alpha.1`	`4.4.6`

Products include Nuxt Nuxt\/Rspack-Builder, Nuxt Nuxt\/Webpack-Builder.

How do I fix CVE-2026-45670?

Upgrade @nuxt/rspack-builder to a fixed version for your release line: 3.21.6 or 4.4.6.

Is CVE-2026-45670 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45670 exists.

CVE-2026-49993 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) Medium 5.9

Sources

Also known as GHSA-6m52-m754-pw2g.