CVE-2026-128072: @nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages
Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /nuxt/.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@nuxt/webpack-builderto a version that resolves this vulnerability.Fixed in 4.6.4 - Upgrade
Upgrade
@nuxt/rspack-builderto a version that resolves this vulnerability.Fixed in 4.6.4
Event History
Frequently Asked Questions
Which Nuxt deployments are exposed?
Only development servers using @nuxt/webpack-builder versions 3.0.0 through before 4.6.4, or @nuxt/rspack-builder versions 3.12.2 through before 4.6.4, are affected. The default Vite builder and production builds are unaffected.
What must an attacker do to exploit this issue?
The attacker must cause a developer to open a malicious page and know or guess the development server's port. The attack relies on DNS rebinding so an attacker-controlled hostname resolves to a loopback address while retaining the same hostname in the request headers.
What information could be exposed?
An attacker can read /_nuxt/*.js client chunks and inline source maps from the development server. This can expose compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle.
Do browser protections reduce exposure?
Chrome 142 and later, along with other Chromium-based browsers that enforce Local Network Access restrictions, prompt before a public page can reach a loopback address. Exploitation still depends on the developer opening the malicious page and responding to any applicable browser prompt.
What is the remediation?
Upgrade the affected Nuxt builder to version 4.6.4, which fixes the issue.