CVE-2026-119198: Nuxt dev server arbitrary file read through client error reports
Summary
A client that can connect to the dev server's HMR socket can send a nuxt:dev:client-error event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in the report shown in the terminal.
Impact
This affects the development server only; production builds contain none of this code. Affected versions are 4.6.0 to 4.6.2.
Reading the file requires TCP access to the dev server, so the default localhost bind limits this to local processes, which can usually read the same files directly. With the dev server exposed to a network (nuxt dev --host, nuxt dev --tunnel, or a proxy onto the dev port), anyone who can reach the port can read any file the dev process can read: SSH keys, .env files, cloud credentials and other files outside the project. The same path is refused by Vite's server.fs allow list over /nuxt/@fs/; the client error channel bypasses that check.
No user interaction is needed and no browser is involved: a plain WebSocket client is enough, as long as it does not send Sec-Fetch-Site: cross-site. A web page on another origin cannot retrieve the report: the overlay and channel endpoints reject browser requests from other origins.
Nuxt 3 is not affected.
Patches
Fixed in @nuxt/vite-builder 4.6.3, which nuxt 4.6.3 depends on. A client-reported error is no longer turned into a compile report, and report building for it no longer reads from the filesystem; file content now comes only from the dev server's module graph.
Workarounds
Do not expose the dev server to untrusted networks: keep the default localhost bind, and avoid nuxt dev --host, nuxt dev --tunnel and proxies onto the dev port. If the dev port was reachable from an untrusted network while a vulnerable version was running, treat any file readable by the dev process on that machine as exposed, and rotate credentials such as SSH keys and .env secrets.
Credits
Thanks to @samsulselfut for the report.
Other sources
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@nuxt/vite-builderto a version that resolves this vulnerability.Fixed in 4.6.3 - Upgrade
Upgrade
@nuxt/vite-builderto a version that resolves this vulnerability.Fixed in 4.6.3 - Compensating control
Do not expose the Nuxt development server to untrusted networks: keep the default localhost bind and avoid `nuxt dev --host`, `nuxt dev --tunnel`, and proxies onto the dev port.
- Operational
If the dev port was reachable from an untrusted network while a vulnerable version was running, treat readable files as exposed and rotate credentials such as SSH keys and `.env` secrets.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
The default localhost bind limits exposure to local processes, which can generally already read the same files. Risk becomes significant when the development server is reachable over a network, including through nuxt dev --host, nuxt dev --tunnel, or a proxy that exposes the development port.
What does an attacker need to exploit this?
An attacker needs TCP access to the dev server's HMR socket and can use a plain WebSocket client; no browser or user interaction is required. The client must not send Sec-Fetch-Site: cross-site.
What data could be disclosed?
An attacker can read any file that the dev-server process can read, including files outside the project. Examples given include SSH keys, .env files, and cloud credentials.
How can I determine whether an environment is affected?
Check whether npm/@nuxt/vite-builder is version 4.6.0 through 4.6.2 and whether its development server is exposed beyond localhost. Production builds are not affected because they do not contain this development-server code.
What can be done if updating is not immediately possible?
Keep the development server bound to localhost and remove network paths to its dev port, including tunnels and proxies. This prevents remote clients from reaching the HMR socket.