Description
Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.
Recommendation
Update the @nuxt/vite-builder package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.8.1, < 3.15.3
- Patched version(s): 3.15.3
References
Could your website be exposed too?
SmartScanner can check your website for Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/vite-builder and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder - CVE-2026-45670
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - CVE-2026-45670
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2025