UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128070

Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file

Severity
Medium 5.9
Published
2 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
4.0.0, 4.6.4
Weakness
Files or directories accessible to outside parties (CWE-552)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Also known as
GHSA-mjrq-cffv-q4qc
Sources
CVE Program, Project advisories (GitHub)

Description

Nuxt can pick a parent directory that does not declare a workspace as its default workspaceDir: the farthest directory with a lockfile when the project is not inside a git repository, or the farthest directory with a pnpm-workspace.yaml or deno.json file, even one that only holds settings. The Vite dev server allows /_nuxt/@fs/ requests for any file under workspaceDir. A stray lockfile or settings file in a parent directory, such as the home directory, therefore lets anyone who can reach the dev server read files in that directory and everything below it.

This affects the development server only; production builds are not affected. All of the following have to hold:

  • A parent directory contains either:
  • a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock and similar), while the project is not inside a git repository and has no workspace file (pnpm-workspace.yaml, turbo.json, lerna.json and similar) above it.
From nuxt/nuxt's security advisory. Shortened; the full text is there.

Workarounds

Set workspaceDir explicitly in nuxt.config.ts to the project root (or to the real monorepo root), or remove the stray lockfile or settings file from the parent directory. Do not expose the dev server to untrusted networks. If the dev port was reachable from an untrusted network while this layout was in place, treat files in the parent directory as exposed and rotate credentials such as SSH keys and cloud tokens.

Workarounds as given by nuxt/nuxt's security advisory.

Affected software

SoftwareAffected versions
NuxtServers and applications · cna:nuxt|nuxt
  • From 3.5.0 before 4.6.4
NuxtServers and applications · github:nuxt/nuxt
  • From 3.5.0 before 4.0.0
  • From 4.0.0 before 4.6.4

References