CVE-2026-72744

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

PT-2026-70157

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

GHSA-7C4V-FWGW-9RF7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

Missing Authentication for Critical Function

Overview @nuxt/devtools is a Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the nuxt:devtools:rpc. An attacker can execute arbitrary commands on the host system by sending crafted RPC calls to the exposed WebSocket endpoint without...

CLSA-2026-1784769523 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.11.3-tuxcare.3...

CLSA-2026-1774398063 TuxCare security update for webpack-dev-server (2 CVEs)

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.7.3-tuxcare.1...

EUVD-2026-41559

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header...

The vulnerability of the Vite application development local server relates to incorrect path name restrictions for the directory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Vite application development local server is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-14620

A flaw was found in webpack-dev-server. This vulnerability allows a remote attacker to exploit exposed internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, through cross-origin requests. By visiting a malicious website while the development server is...

Improper Input Validation

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Improper Input Validation through the host-validation process. An attacker can cause t...

PT-2026-55576

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6 Description An unauthenticated peer can cause the Node.js process to terminate, resulting in a denial of service. This occurs when the server receives a normal HTTP request with a malformed Host heade...

CVE-2026-56301

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

EUVD-2026-38436

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

PT-2026-51509

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7 Description When running the development server on Linux, the vite-node IPC Inter-Process Communication server binds to an abstract-namespace Unix socket without permission restriction...

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

Summary When running nuxt dev, Nuxt registers an unauthenticated route at /.well-known/appspecific/com.chrome.devtools.json that returns the absolute filesystem path of the project root and a per-project UUID persisted to nodemodules/.cache/nuxt/chrome-workspace.json. The route is enabled by...