CVE-2026-128072
@nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages
- Low 3.1
Description
Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- GitHub_M
- EPSS
- 0.136% likely to be exploited in the next 30 days, higher than 3.092% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 3.1CVSS 3.1, Lowfrom the CNA (GitHub_M)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| nuxt | nuxt |
|
| @nuxt | webpack-builder |
|
| @nuxt | rspack-builder |
|
Timeline
- 13 Nov 2026 Published
Weakness
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2
- https://github.com/nuxt/nuxt/commit/3c9645326a2b3f5cfa09c9a935db9b1825d560e7
- https://github.com/nuxt/nuxt/commit/3e1c7964e6843e1c5f218867a4ccd4cd00ad9ebb
- https://github.com/nuxt/nuxt/commit/8c11d965dad5bfc58d4c25e796915aec045acb78
- https://github.com/nuxt/nuxt/commit/f8d64c9aa773a033596532365d455890da9da197
- https://github.com/nuxt/nuxt/releases/tag/v4.6.4