CVE-2026-56301: Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nuxtto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Nuxtto a version that resolves this vulnerability.Fixed in 3.21.7 - Compensating control
When running nuxt dev on Linux, ensure only trusted local users can access the development host/network; prevent unprivileged co-resident users from connecting to the vite-node IPC server (e.g., by isolating the dev environment or restricting local access).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56301?
The severity of CVE-2026-56301 is rated as medium with a score of 5.5.
How do I fix CVE-2026-56301?
To fix CVE-2026-56301, upgrade Nuxt to version 4.4.7 or 3.21.7 or later.
What are the potential impacts of CVE-2026-56301?
CVE-2026-56301 allows unprivileged local users to read arbitrary files from the server due to improper socket permissions.
Which versions of Nuxt are affected by CVE-2026-56301?
CVE-2026-56301 affects Nuxt versions prior to 4.4.7 and 3.18.0 before 3.21.7.
Is CVE-2026-56301 a local or remote vulnerability?
CVE-2026-56301 is a local vulnerability that requires unprivileged co-resident users to exploit.