Vulnerability-Lookup

CVE-2026-119199 (GCVE-0-2026-119199)

Vulnerability from cvelistv5 – Published: 2026-10-29 20:14 – Updated: 2026-10-29 20:27

Title

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Summary

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 20:27 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7913 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nuxt/nuxt/security/advisories/…	x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/12b58f9d87686…	x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.6.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
nuxt	nuxt	Affected: >= 3.0.0, < 4.6.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119199",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:27:35.512756Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:27:59.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 4.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at \u003cbuildDir\u003e/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-538",
              "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T20:14:22.499Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7"
        },
        {
          "name": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca"
        },
        {
          "name": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
        }
      ],
      "source": {
        "advisory": "GHSA-648h-gw55-m2g7",
        "discovery": "UNKNOWN"
      },
      "title": "Nuxt dev server exposes private runtime config through the Nitro dev bundle"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119199",
    "datePublished": "2026-10-29T20:14:07.854Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-10-29T20:27:59.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-119199",
      "date": "2026-11-04",
      "epss": "0.0035",
      "percentile": "0.28838"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nuxt",
                "vendor": "nuxt",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.0.0, \u003c 4.6.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at \u003cbuildDir\u003e/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3."
          }
        ],
        "id": "CVE-2026-119199",
        "lastModified": "2026-10-30T17:18:03.880",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-119199",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:27:35.512756Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-29T21:17:18.797",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              },
              {
                "lang": "en",
                "value": "CWE-538"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-119199",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-29T20:27:35.512756Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-29T20:27:53.996Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nuxt",
              "vendor": "nuxt",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.0.0, \u003c 4.6.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at \u003cbuildDir\u003e/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-538",
                  "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-29T20:14:22.499Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7"
            },
            {
              "name": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca"
            },
            {
              "name": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
            }
          ],
          "source": {
            "advisory": "GHSA-648h-gw55-m2g7",
            "discovery": "UNKNOWN"
          },
          "title": "Nuxt dev server exposes private runtime config through the Nitro dev bundle"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-119199",
        "datePublished": "2026-10-29T20:14:07.854Z",
        "dateReserved": "2026-10-29T16:04:48.728Z",
        "dateUpdated": "2026-10-29T20:27:59.121Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-119199

Vulnerability from fkie_nvd - Published: 2026-10-29 21:17 - Updated: 2026-10-30 17:18

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca
	security-advisories@github.com	https://github.com/nuxt/nuxt/releases/tag/v4.6.3
	security-advisories@github.com	https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nuxt",
          "vendor": "nuxt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 4.6.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at \u003cbuildDir\u003e/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3."
    }
  ],
  "id": "CVE-2026-119199",
  "lastModified": "2026-10-30T17:18:03.880",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-119199",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-29T20:27:35.512756Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-29T21:17:18.797",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-538"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-648H-GW55-M2G7

Vulnerability from github – Published: 2026-10-30 23:00 – Updated: 2026-10-30 23:00

Summary

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Details

Summary

With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by nuxt dev can be fetched through the Vite dev server. Nitro inlines the resolved runtimeConfig into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.

Impact

nuxt dev writes the Nitro development server bundle to <buildDir>/dev/index.mjs (by default .nuxt/dev/index.mjs). The build directory is inside the directories Nuxt passes to Vite's server.fs.allow, so the bundle is served by the dev server:

curl http://<dev-server>/_nuxt/@fs/<absolute-path-to-project>/.nuxt/dev/index.mjs

The response contains every private (non-public) runtime config value that was resolved at build time. That includes values set in nuxt.config, such as a secret read from .env:

export default defineNuxtConfig({
  runtimeConfig: {
    apiSecret: process.env.API_SECRET,
  },
})

From Nuxt 4.6.0, it also includes the generated development appSecret. Vite's default deny list blocks .env itself, but not the bundle containing values read from it.

Exploitation requires direct HTTP access to the dev server. nuxt dev listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with --host, a published container port or a tunnel). As far as we can tell, a malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response.

Production builds are not affected, because the Vite dev server is not used and the server bundle is not served. Nuxt projects using Nitro 3 do not write the server bundle to disk in development and are not affected. Private runtime config values that are left empty in nuxt.config and supplied through NUXT_* environment variables are applied when the server starts, are not inlined into the bundle, and are not exposed.

Patches

Fixed in @nuxt/vite-builder 4.6.3, which nuxt 4.6.3 depends on. The dev server now adds Nitro's development output directory to Vite's server.fs.deny, keeping Vite's default deny list.

Nuxt 3 has reached end of life and will not receive a fix.

Workarounds

Avoid exposing the dev server to untrusted networks. Alternatively, set private runtime config keys to an empty default in nuxt.config and provide their values with the matching NUXT_* environment variables (for example runtimeConfig: { apiSecret: '' } with NUXT_API_SECRET in .env).

If a dev server has been reachable by untrusted clients, rotate any credentials that were set through runtimeConfig in nuxt.config.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@nuxt/vite-builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "4.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-119199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-538",
      "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-30T23:00:43Z",
    "nvd_published_at": "2026-10-29T21:17:18Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `\u003cbuildDir\u003e/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite\u0027s `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http://\u003cdev-server\u003e/_nuxt/@fs/\u003cabsolute-path-to-project\u003e/.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite\u0027s default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitation requires direct HTTP access to the dev server. `nuxt dev` listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with `--host`, a published container port or a tunnel). As far as we can tell, a malicious website cannot read the file through a developer\u0027s browser: Vite\u0027s CORS and host checks prevent pages on other origins from reading the response.\n\nProduction builds are not affected, because the Vite dev server is not used and the server bundle is not served. Nuxt projects using Nitro 3 do not write the server bundle to disk in development and are not affected. Private runtime config values that are left empty in `nuxt.config` and supplied through `NUXT_*` environment variables are applied when the server starts, are not inlined into the bundle, and are not exposed.\n\n### Patches\n\nFixed in `@nuxt/vite-builder` 4.6.3, which `nuxt` 4.6.3 depends on. The dev server now adds Nitro\u0027s development output directory to Vite\u0027s `server.fs.deny`, keeping Vite\u0027s default deny list.\n\nNuxt 3 has reached end of life and will not receive a fix.\n\n### Workarounds\n\nAvoid exposing the dev server to untrusted networks. Alternatively, set private runtime config keys to an empty default in `nuxt.config` and provide their values with the matching `NUXT_*` environment variables (for example `runtimeConfig: { apiSecret: \u0027\u0027 }` with `NUXT_API_SECRET` in `.env`).\n\nIf a dev server has been reachable by untrusted clients, rotate any credentials that were set through `runtimeConfig` in `nuxt.config`.",
  "id": "GHSA-648h-gw55-m2g7",
  "modified": "2026-10-30T23:00:43Z",
  "published": "2026-10-30T23:00:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt/nuxt"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt/nuxt/releases/tag/v4.6.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nuxt dev server exposes private runtime config through the Nitro dev bundle"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-119199 (GCVE-0-2026-119199)

FKIE_CVE-2026-119199

GHSA-648H-GW55-M2G7

Summary

Impact

Patches

Workarounds

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour