CVE-2026-119201: Nuxt dev server exposes generated appSecret through Vite file serving
Impact
When no appSecret is configured (via NUXTAPPSECRET, NITROAPPSECRET or runtimeConfig.appSecret), nuxt dev generates a development secret and stores it in <buildDir>/app-secret (by default .nuxt/app-secret). The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the file can be fetched from the dev server:
bash curl http://<dev-server>/nuxt/@fs/<absolute-path-to-project>/.nuxt/app-secret
Anyone who can read it can compute every secret derived from it with deriveSecret(), including the default password used by useSession, and so can forge session cookies accepted by that dev server.
Exploitation requires direct HTTP access to the dev server. nuxt dev listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with --host, a published container port or a tunnel). A malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response.
Production builds never generate an appSecret and are not affected. Dev servers with an explicitly configured appSecret do not use the generated file.
Patches
Fixed in @nuxt/vite-builder 4.6.3, which nuxt 4.6.3 depends on. The dev server now adds app-secret to Vite's server.fs.deny, keeping Vite's default deny list.
Workarounds
Set NUXTAPPSECRET in .env to a random value of at least 32 characters (for example the output of openssl rand -base64 32), or avoid exposing the dev server to untrusted networks.
If a dev server using a generated secret has been reachable by untrusted clients, delete .nuxt/app-secret (a new secret is generated on the next nuxt dev) or set NUXTAPPSECRET. Either invalidates existing dev sessions.
Other sources
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@nuxt/vite-builderto a version that resolves this vulnerability.Fixed in 4.6.3 - Upgrade
Upgrade
nuxtto a version that resolves this vulnerability.Fixed in 4.6.3 - Configuration
Set NUXT_APP_SECRET in .env to a random value of at least 32 characters, such as the output of openssl rand -base64 32.
Nuxt dev server NUXT_APP_SECRET = A random value of at least 32 characters - Compensating control
Avoid exposing the Nuxt development server to untrusted networks; nuxt dev listens on localhost by default.
- Operational
If a dev server using a generated secret was reachable by untrusted clients, delete .nuxt/app-secret; a new secret is generated on the next nuxt dev.
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
The main risk is to development servers reachable over the network, such as instances started with --host, containers with a published port, or servers exposed through a tunnel. Nuxt dev listens on localhost by default, so a local-only development server is not the primary exposure.
What does an attacker need to exploit this?
An attacker needs direct HTTP access to the affected Nuxt development server. A malicious website cannot retrieve the file through a developer's browser because Vite's CORS and host checks prevent cross-origin pages from reading the response.
What could an attacker do after obtaining the generated secret?
They can compute secrets derived with deriveSecret(), including the default password used by useSession. This allows them to forge session cookies that the affected development server accepts.
How can I determine whether a development server is affected?
Check whether it is running nuxt dev, is network-accessible, and has no appSecret configured through NUXT_APP_SECRET, NITRO_APP_SECRET, or runtimeConfig.appSecret. Production builds do not generate an appSecret and are not affected.