CVE-2026-49993 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Medium 5.9 Published 12 Jun 2026 Updated 12 Jun 2026

Attackers can steal source code from Nuxt dev servers bound to non-loopback addresses by bypassing same-origin checks when specific headers are absent.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-49993?

CVE-2026-49993 is a medium-severity vulnerability in nuxt, published on 12 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

Weakness: CWE-749

Which versions are affected by CVE-2026-49993?

8 open source packages ship an affected version, including @nuxt/rspack-builder and @nuxt/webpack-builder. It affects 2 products.

Package	Affected	Fixed in
`@nuxt/rspack-builder` npm	From `3.15.4`	`3.21.7`
`@nuxt/rspack-builder` npm	From `3.15.4`	`3.21.7`
`@nuxt/rspack-builder` npm	From `4.0.0`	`4.4.7`
`@nuxt/rspack-builder` npm	From `4.0.0`	`4.4.7`
`@nuxt/webpack-builder` npm	From `3.15.4`	`3.21.7`
`@nuxt/webpack-builder` npm	From `3.15.4`	`3.21.7`

2 more packages

`@nuxt/webpack-builder` npm	From `4.0.0`	`4.4.7`
`@nuxt/webpack-builder` npm	From `4.0.0`	`4.4.7`

Products include Nuxt Nuxt\/Rspack-Builder, Nuxt Nuxt\/Webpack-Builder.

How do I fix CVE-2026-49993?

Upgrade @nuxt/rspack-builder to a fixed version for your release line: 3.21.7 or 4.4.7.

Is CVE-2026-49993 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49993 exists.

CVE-2026-45670 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) Medium 5.9

Sources

Also known as GHSA-x6qj-4h56-5rj5.