PT-2026-41963 · Npm · @Nuxt/Webpack-Builder+1
CVSS v4.0
5.9
Medium
| Vector | AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@nuxt/rspack-builder versions 3.15.4 through 3.21.5
@nuxt/rspack-builder versions 4.0.0-alpha.1 through 4.4.5
@nuxt/webpack-builder versions 3.15.4 through 3.21.5
@nuxt/webpack-builder versions 4.0.0-alpha.1 through 4.4.5
Description
An incomplete fix in the webpack and rspack builders allows source code to be stolen during development. This occurs if the development server is bound to a non-loopback address (for example, by using
nuxt dev --host) and a developer visits a malicious website on the same network. The issue stems from a reliance on Sec-Fetch-Mode and Sec-Fetch-Site headers, which browsers only send for potentially trustworthy origins, allowing the check to be bypassed for non-trustworthy origins.Recommendations
Update @nuxt/rspack-builder versions 3.15.4 through 3.21.5 to version 3.21.6.
Update @nuxt/rspack-builder versions 4.0.0-alpha.1 through 4.4.5 to version 4.4.6.
Update @nuxt/webpack-builder versions 3.15.4 through 3.21.5 to version 3.21.6.
Update @nuxt/webpack-builder versions 4.0.0-alpha.1 through 4.4.5 to version 4.4.6.
Avoid using the
nuxt dev --host command and bind the development server to localhost.
Switch to the Vite builder for development.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Nuxt/Rspack-Builder
@Nuxt/Webpack-Builder