Skip to content
OpenAdvisories

Package · npm

@nuxt/webpack-builder

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.9
    CVE-2026-49993

    @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

    Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen…

    nuxt nuxt @nuxt/rspack-builder @nuxt/webpack-builder npm
  • Medium 5.9
    CVE-2026-45670

    Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

    Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen d…

    nuxt nuxt @nuxt/rspack-builder @nuxt/webpack-builder npm
  • Medium 5.3
    CVE-2025-24361

    Opening a malicious website while running a Nuxt dev server could allow read-only access to code

    Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Be…

    nuxt nuxt @nuxt/rspack-builder @nuxt/webpack-builder npm