A vulnerability in @nuxt/vite-builder versions 4.6.0 to 4.6.2 allows an attacker with TCP access to the Nuxt development server to read arbitrary files on the server filesystem by sending a crafted client error event. This issue affects only the development server and not production builds. The vulnerability is mitigated by default localhost binding, but exposing the dev server to untrusted networks can lead to sensitive file disclosure. The issue is fixed in version 4.6.3.