CVE-2026-49993: @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Summary This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network.
Details The fix for GHSA-6m52-m754-pw2g added an Origin / Referer fallback to the dev-middleware same-origin check, with a return true branch when neither header is present so that non-browser clients (curl, the HMR client, address-bar navigation) keep working.
That fallback is bypassed when a cross-origin attacker request reaches the dev server with all three signal headers absent:
- Sec-Fetch-Site is not sent by browsers to non-potentially-trustworthy destinations (HTTP on a non-loopback address). - Origin is not sent on non-CORS subresource fetches (a bare <script> with no crossorigin). - Referer can be suppressed by the attacker page with <meta name="referrer" content="no-referrer"> or referrerpolicy="no-referrer" on the <script> element.
A classic <script src="http://VICTIMLANIP:3000/nuxt/app.js" referrerpolicy="no-referrer"> from a non-trustworthy attacker origin produces exactly that header set, the request is allowed, and the attacker page can read the built source out of window.webpackChunk via Function.prototype.toString().
Since the attack requires the dev server to be reachable via a non-potentially-trustworthy origin, only apps using --host (or --host 0.0.0.0) are affected. Chrome 142+ users are also protected by Local Network Access restrictions.
PoC 1. Create a Nuxt project with the webpack / rspack builder. 1. Run npm run dev -- --host 0.0.0.0. 1. Open http://localhost:3000 on the developer machine. 1. From a different LAN host, serve the page below and open it in the same browser. 1. The compiled module source is exfiltrable from window.webpackChunknuxt<projectname>.
html <!doctype html> <meta name="referrer" content="no-referrer"> <script> ['/nuxt/runtime.js', '/nuxt/app.js'].forEach(p => { const s = document.createElement('script') s.src = 'http://VICTIMLANIP:3000' + p s.referrerPolicy = 'no-referrer' document.head.appendChild(s) }) setTimeout(() => { const key = Object.keys(window).find(k => k.startsWith('webpackChunk')) for (const [, mods] of window[key]) { for (const id in mods) { console.log(id, mods[id].toString()) } } }, 1500) </script>
Impact Users using the webpack / rspack builder with nuxt dev --host may get the built source code read by malicious websites on the same network, including module identifiers, the developer's local filesystem path, and any developer-controlled strings inlined into the bundle.
This vulnerability does not affect Chrome 142+ (and other Chromium-based browsers) users due to Local Network Access restrictions.
The default Vite builder is not affected.
Patches Fixed in @nuxt/webpack-builder@4.4.7 / @nuxt/rspack-builder@4.4.7 and backported to @nuxt/webpack-builder@3.21.7 / @nuxt/rspack-builder@3.21.7 by #35200 (4.x: commit e351de94; 3.x: commit 77187ee4). The dev-middleware same-origin check now treats a request with no Sec-Fetch-Site, no Origin, and no Referer as same-origin only when the dev server is loopback-bound, closing the header-suppression bypass.
The fix only ships for the @nuxt/webpack-builder and @nuxt/rspack-builder packages. The default Vite builder was not affected.
Workarounds If you cannot upgrade immediately:
- Don't use nuxt dev --host. Bind the dev server to localhost (the default) and tunnel from other devices via SSH or a reverse proxy that enforces same-origin checks. - Use Chrome 142+ or another Chromium-based browser that enforces Local Network Access restrictions. - Switch to the Vite builder for development.
Credit Reported by Berkan SAL (@Uhudsavasindankacanokcu2) via the Vercel Open Source HackerOne program.
Independently reported by @DavidCarliez via GitHub's coordinated disclosure flow (GHSA-xw96-2f5x-v9pv), closed as a duplicate of this advisory.
Other sources
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@nuxt/rspack-builderto a version that resolves this vulnerability.Fixed in 3.21.7 - Upgrade
Upgrade
npm/@nuxt/rspack-builderto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
npm/@nuxt/webpack-builderto a version that resolves this vulnerability.Fixed in 3.21.7 - Upgrade
Upgrade
npm/@nuxt/webpack-builderto a version that resolves this vulnerability.Fixed in 4.4.7 - Configuration
Do not run the dev server with --host (e.g. avoid `nuxt dev --host`); bind the dev server to localhost (the default) so it is not reachable from non-loopback network hosts.
dev server host = localhost - Configuration
Switch to the Vite builder for development (the default Vite builder is not affected).
Nuxt builder = vite - Compensating control
If you must make the dev server reachable from other devices, tunnel access via SSH or use a reverse proxy that enforces same-origin checks to restrict requests.
- Compensating control
Use Chrome 142+ or another Chromium-based browser that enforces Local Network Access restrictions to mitigate exposure when accessing the dev server from the browser.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49993?
CVE-2026-49993 has a medium severity rating of 5.9 according to CVSS.
How do I fix CVE-2026-49993?
To fix CVE-2026-49993, update @nuxt/webpack-builder and @nuxt/rspack-builder to versions 3.21.7 or later, or 4.4.7 or later.
What systems are affected by CVE-2026-49993?
CVE-2026-49993 affects versions of @nuxt/webpack-builder from 3.15.4 to before 3.21.7 and @nuxt/rspack-builder from 4.0.0 to before 4.4.7.
What type of attack is CVE-2026-49993 associated with?
CVE-2026-49993 is associated with a bypass that can allow source code to be stolen during development.
When was CVE-2026-49993 published?
CVE-2026-49993 was published on June 12, 2026.