Description
This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network.
Recommendation
Update the @nuxt/rspack-builder package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0-alpha.1, <= 4.4.5 >= 3.15.4, <= 3.21.5** Patched version(s): **4.4.6 3.21.6**
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder - CVE-2026-45670
- @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Re - CVE-2026-49993
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
You might also like:
See something that needs correcting? Let us knowUpdated July 08, 2026