CLSA-2026-1792161813 TuxCare security update for @nuxt/vite-builder (1 CVE)

TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.3-tuxcare.4...

CLSA-2026-1792161812 TuxCare security update for @nuxt/vite-builder (2 CVEs)

TuxCare rebuilt @nuxt/vite-builder to address 2 CVEs. Fixed in 3.12.4-tuxcare.7...

CLSA-2026-1792160954 TuxCare security update for @nuxt/vite-builder (10 CVEs)

TuxCare rebuilt @nuxt/vite-builder to address 10 CVEs. Fixed in 4.0.3-tuxcare.4...

@classement-des-associations/website-theme (>=0.1.3, <=0.1.4), @dword-design/nuxt (3.1.0) +41 more potentially affected by unknown CVE via @nuxt/vite-builder (>=0.1.1, <=3.4.1)

@nuxt/vite-builder NPM version =0.1.1, =0.1.3, =0.1.0, =1.0.0-beta.11, =1.0.0-beta.2, =0.13.0, =0.7.2, =0.7.3, =0.9.1, =0.13.1, =0.7.2, =0.27.1, =0.8.1, =0.17.0 - @neon.id/gerbang-interfaces 1.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2023-0126...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @bloggrify/bento (>=0.9.1, <=1.0.0) +27 more potentially affected by CVE-2025-24360 via @nuxt/vite-builder (>=3.8.1, <=3.15.2)

@nuxt/vite-builder NPM version =3.8.1, =1.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.1024, =3.2.0, =0.2.3, =0.2.0-alpha.2, =0.2.0 - @xizs/nuxt-base 0.0.2 and more Source cves: CVE-2025-24360 Source advisory: OSV:GHSA-2452-6XJ8-JH47...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @bloggrify/bento (>=0.9.1, <=1.0.0) +27 more potentially affected by CVE-2025-24360 via @nuxt/vite-builder (>=3.8.1, <=3.15.2)

@nuxt/vite-builder NPM version =3.8.1, =1.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.1024, =3.2.0, =0.2.3, =0.2.0-alpha.2, =0.2.0 - @xizs/nuxt-base 0.0.2 and more Source cves: CVE-2025-24360 Source advisory: GHSA-2452-6XJ8-JH47...

CVE-2025-24360 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @bloggrify/bento (>=0.9.1, <=1.0.0) +27 more potentially affected by CVE-2025-24360 via @nuxt/vite-builder (>=3.8.1, <=3.15.2)

@nuxt/vite-builder NPM version =3.8.1, =1.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.1024, =3.2.0, =0.2.3, =0.2.0-alpha.2, =0.2.0 - @xizs/nuxt-base 0.0.2 and more Source cves: CVE-2025-24360 Source advisory: MEND:CVE-2025-24360...

CVE-2025-24360

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

CVE-2025-24360: Exposure of Sensitive Information to an Unauthorized Actor

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

PT-2025-5342 · Vite +1 · Vite +1

Name of the Vulnerable Software and Affected Versions: Nuxt versions 3.8.1 through 3.15.2 Description: The issue arises due to default CORS settings in Nuxt, allowing any website to send requests to the development server and read the response. This can lead to source code theft by malicious...