Description
A client that can connect to the dev server’s HMR socket can send a nuxt:dev:client-error event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in the report shown in the terminal.
Recommendation
Update the @nuxt/vite-builder package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.6.0, < 4.6.3
- Patched version(s): 4.6.3
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt dev server arbitrary file read through client error reports and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt dev server exposes generated appSecret through Vite file serving - CVE-2026-119201
- Nuxt dev server exposes private runtime config through the Nitro dev bundle - CVE-2026-119199
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder - CVE-2025-24360
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026