Threats tagged 'ghsa-648h-gw55-m2g7'

A vulnerability in the Nitro development server bundle used by Nuxt 3 and Nuxt 4 with Nitro 2 allows private runtime configuration values to be exposed through the Vite dev server. This occurs because the Nitro dev server bundle inlines private runtime config values, which can be fetched via HTTP if the dev server is exposed to a network. Production builds and Nitro 3 are not affected. The issue is fixed in @nuxt/vite-builder 4.6.3.