Nuxt versions 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7 have a vulnerability in the development server on Linux where the vite-node IPC server binds to an abstract-namespace Unix socket without permission restrictions. This allows local unprivileged users to connect to the socket and potentially read sensitive files such as .env and SSH keys through the SSR plugin pipeline. Production builds are not affected as this IPC server runs only in development mode.