Skip to content
OpenAdvisories

Package · npm

@nuxt/vite-builder

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-119201

    Nuxt dev server exposes generated appSecret through Vite file serving

    Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direc…

    nuxt nuxt @nuxt/vite-builder npm
  • Medium 5.9
    CVE-2026-119199

    Nuxt dev server exposes private runtime config through the Nitro dev bundle

    Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inli…

    nuxt nuxt @nuxt/vite-builder npm
  • Medium 5.9
    CVE-2026-119198

    Nuxt dev server arbitrary file read through client error reports

    Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message…

    nuxt nuxt @nuxt/vite-builder npm
  • Medium 5.3
    CVE-2025-24360

    Opening a malicious website while running a Nuxt dev server could allow read-only access to code

    Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the defa…

    nuxt nuxt @nuxt/vite-builder npm