ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-119201

Nuxt dev server exposes generated appSecret through Vite file serving

Published Oct 27, 2026 · catalog updated Oct 30, 2026 · Nuxt dev server exposes

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119201. EPSS is 0.21%. Act only if a listed version of Nuxt dev server exposes is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nuxt dev server exposes).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.21%
Remediation
Version ranges on file
Affected products
npm @nuxt · npm @nuxt/vite-builder

### Impact When no is configured (via , or ), generates a development secret and stores it in (by default ). The build directory is inside the directories that Nuxt passes to Vite's , so the file can be fetched from the dev server: Anyone who can read it can compute every secret derived from it with , including the default password used by , and so can forge session cookies accepted by that dev server. Exploitation requires direct HTTP access to the dev server. listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with , a published container port or a tunnel). A malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response. Production builds never generate an and are not affected. Dev servers with an explicitly configured do not use the generated file. ### Patches Fixed in 4.6.3, which 4.6.3 depends on. The dev server now adds to Vite's , keeping Vite's default deny list. ### Workarounds Set in to a random value of at least 32 characters (for example the output of ), or avoid exposing the dev server to untrusted networks. If a dev server using a generated secret has been reachable by untrusted clients, delete (a new secret is generated on the next ) or set . Either invalidates existing dev sessions.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @nuxtversion unspecified
  • npm @nuxt/vite-builder>= 4.6.0 < 4.6.3
  • npm @nuxt/vite-builder>= 4.6.0, < 4.6.3

How to fix CVE-2026-119201

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119201. EPSS is 0.21%. Act only if a listed version of Nuxt dev server exposes is installed.

Which versions are affected?

Compare what you have installed with >= 4.6.0 < 4.6.3, >= 4.6.0, < 4.6.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-552: Files or Directories Accessible to External Parties. EPSS 0.21%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Impact When no is configured (via , or ), generates a development secret and stores it in (by default ). The build directory is inside the directories that Nuxt passes to Vite's , so the file can be fetched from the dev server: Anyone who can read it can compute every secret derived from it with , including the default password used by , and so can forge session cookies accepted by that dev se

  2. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Impact When no is configured (via , or ), generates a development secret and stores it in (by default ). The build directory is inside the directories that Nuxt passes to Vite's , so the file can be fetched from the dev server: Anyone who can read it can compute every secret derived from it with , including the default password used by , and so can forge session cookies accepted by that dev se

Sources

  • CVE.orgVulnerability recordCVE-2026-119201

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-3xf4-9g3c-4h4w

    Nuxt dev server exposes generated appSecret through Vite file serving

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119201

    When no appSecret is configured (via NUXT_APP_SECRET, NITRO_APP_SECRET or runtimeConfig.appSecret), nuxt dev generates a development secret and stores it in /app-secret (by default .nuxt/app-secret). The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the file can be fetched from the dev server: curl http:// /_nuxt/@fs/ /.nuxt/app-secret Anyone who can read

    advisories.gitlab.com
  • Maintainer security tabsVendor advisoryGHSA-3xf4-9g3c-4h4w

    ### Impact When no is configured (via , or ), generates a development secret and stores it in (by default ). The build directory is inside the directories that Nuxt passes to Vite's , so the file can be fetched from the dev server: Anyone who can read it can compute every secret derived from it with , including the default password used by , and so can forge session cookies accepted by that dev se

    github.com

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • GitLab Advisory DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026
  • GitHub Advisory DatabaseOct 31, 2026