This vulnerability (CVE-2026-72744) affects Nuxt development servers in specific version ranges (>= 4.4.7 < 4.5.1 and >= 3.21.7 < 3.21.10). The flaw is in the Chrome DevTools workspace endpoint, which uses a header-based local-request gate that trusts the Host header supplied by the client rather than verifying the actual network peer address. When the development server is bound to a network-reachable interface and the experimental.chromeDevtoolsProjectSettings feature is enabled (default), an unauthenticated attacker on the LAN can spoof the Host header and send a crafted request without browser-specific headers to obtain sensitive information: the absolute filesystem root path of the project and a persistent per-project workspace UUID. This information disclosure could aid further attacks or reconnaissance. Production builds are unaffected. The vulnerability is fixed in Nuxt versions 4.5.1 and 3.21.10.

An unauthenticated attacker on the local network can exploit this vulnerability to disclose sensitive information about the project directory structure and workspace identifiers. This information disclosure does not affect integrity or availability but can facilitate further attacks or reconnaissance. Production deployments are not impacted.

Upgrade affected Nuxt versions to 4.5.1 or later, or 3.21.10 or later, where this vulnerability is fixed. If upgrading is not immediately possible, avoid binding the development server to network-reachable interfaces or disable the experimental.chromeDevtoolsProjectSettings feature to prevent exploitation. Production builds are not affected and require no action.