Threat Intelligence Database

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10 contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint. The vulnerability arises because the local-request gate relies on a header-based check that trusts the attacker-supplied Host header instead of the actual peer address. This allows an unauthenticated attacker on the local network to retrieve the project's absolute filesystem root path and a persistent workspace UUID. Production builds are not affected. The issue is fixed in versions 4.5.1 and 3.21.10.

A vulnerability in Nuxt development servers allows disclosure of the absolute project root directory and a persistent workspace UUID via a Chrome DevTools endpoint. This occurs when the dev server is bound to a network-reachable interface and the experimental Chrome DevTools workspace feature is enabled. The issue arises because the endpoint's access control relies on headers rather than verifying the actual network peer, allowing any unauthenticated LAN host to retrieve this information. The vulnerability is limited to development servers and does not affect production builds. It has been fixed in Nuxt versions 4.5.1 and 3.21.10 by enforcing loopback-only access based on the TCP peer address. Workarounds include restricting network exposure or disabling the feature in configuration.