CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

EUVD-2026-113370

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at /dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at bui...

CVE-2026-119199

The Nuxt web development framework (versions 3.0.0 through 4.6.3 ) contains a vulnerability where the development server can expose the Nitro 2 development bundle at /dev/index.mjs via Vite file serving when accessible over HTTP. The root cause is that Nitro inlines private runtimeConfig values r...