MEDIUM5.3npm
GHSA-4gf7-ff8x-hq99· CVE-2025-24361Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Modified: 7/8/2026
package
npm/@nuxt/rspack-builder
pkg:npm/%40nuxt/rspack-builder
MEDIUM5.4npm
GHSA-6m52-m754-pw2g· CVE-2026-45670Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
Modified: 7/8/2026
MEDIUMnpm
GHSA-x6qj-4h56-5rj5· CVE-2026-49993@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Modified: 9/10/2026