ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-119199

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Published Oct 27, 2026 · catalog updated Oct 30, 2026 · Nuxt dev server exposes

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119199. EPSS is 0.35%. Act only if a listed version of Nuxt dev server exposes is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nuxt dev server exposes).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Version ranges on file
Affected products
npm @nuxt · npm @nuxt/vite-builder

### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by can be fetched through the Vite dev server. Nitro inlines the resolved into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact writes the Nitro development server bundle to (by default ). The build directory is inside the directories Nuxt passes to Vite's , so the bundle is served by the dev server: The response contains every private (non- ) runtime config value that was resolved at build time. That includes values set in , such as a secret read from : From Nuxt 4.6.0, it also includes the generated development . Vite's default deny list blocks itself, but not the bundle containing values read from it. Exploitation requires direct HTTP access to the dev server. listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with , a published container port or a tunnel). As far as we can tell, a malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response. Production builds are not affected, because the Vite dev server is not used and the server bundle is not served. Nuxt projects using Nitro 3 do not write the server bundle to disk in development and are not affected. Private runtime config values that are left empty in and supplied through environment variables are applied when the server starts, are not inlined into the bundle, and are not exposed. ### Patches Fixed in 4.6.3, which 4.6.3 depends on. The dev server now adds Nitro's development output directory to Vite's , keeping Vite's default deny list. Nuxt 3 has reached end of life and will not receive a fix. ### Workarounds Avoid exposing the dev server to untrusted networks. Alternatively, set private runtime config keys to an empty default in and provid

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @nuxtversion unspecified
  • npm @nuxt/vite-builder3.0.0 → 4.6.3
  • npm @nuxt/vite-builder>= 3.0.0 < 4.0.0
  • npm @nuxt/vite-builder>= 3.0.0, < 4.6.3
  • npm @nuxt/vite-builder>= 4.0.0 < 4.6.3

How to fix CVE-2026-119199

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119199. EPSS is 0.35%. Act only if a listed version of Nuxt dev server exposes is installed.

Which versions are affected?

Compare what you have installed with 3.0.0 → 4.6.3, >= 3.0.0 < 4.0.0, >= 3.0.0, < 4.6.3, >= 4.0.0 < 4.6.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-200: Exposure of Sensitive Information; CWE-538; CWE-552: Files or Directories Accessible to External Parties. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by can be fetched through the Vite dev server. Nitro inlines the resolved into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact writes the Nitro development server bundle to (by defa

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    @nuxt/vite-builder fixed in 4.6.3

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    @nuxt/vite-builder fixed in 4.6.3

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by can be fetched through the Vite dev server. Nitro inlines the resolved into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact writes the Nitro development server bundle to (by defa

Sources

  • CVE.orgVulnerability recordCVE-2026-119199

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-648h-gw55-m2g7

    Nuxt dev server exposes private runtime config through the Nitro dev bundle

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119199

    With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by nuxt dev can be fetched through the Vite dev server. Nitro inlines the resolved runtimeConfig into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.

    advisories.gitlab.com
  • Maintainer security tabsVendor advisoryGHSA-648h-gw55-m2g7

    ### Summary With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by can be fetched through the Vite dev server. Nitro inlines the resolved into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server. ### Impact writes the Nitro development server bundle to (by defa

    github.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-648h-gw55-m2g7

    Nuxt dev server exposes private runtime config through the Nitro dev bundle

    osv.dev

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • GitLab Advisory DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026
  • GitHub Advisory DatabaseOct 31, 2026
  • OpenSSF OSV / OSV ScannerOct 31, 2026