UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128072

@nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages

Severity
Low 3.1
Published
2 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
4.0.0, 4.6.4
Weakness
Origin validation error (CWE-346)
Attack
Over the network · Only under certain conditions · No login needed · Needs someone to click or open something
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Also known as
GHSA-x2wv-5868-p7v2
Sources
CVE Program, Project advisories (GitHub)

Description

When using the webpack or rspack builder, the dev server serves built client chunks to any request whose Host header matches its Origin/Referer, or that carries Sec-Fetch-Site: same-origin. After a DNS rebinding attack both headers name the attacker's hostname, so a malicious page opened while nuxt dev is running can read /_nuxt/*.js and exfiltrate the app's source. This bypasses the same-origin check added for GHSA-4gf7-ff8x-hq99, GHSA-6m52-m754-pw2g and GHSA-x6qj-4h56-5rj5.

A developer runs nuxt dev with builder: 'webpack' or builder: 'rspack' (the default config is enough; --host is not required) and opens a page on an attacker-controlled hostname, for example http://rebind.attacker.example:3000/. The attacker then re-points that hostname at 127.0.0.1. Requests from the page now reach the dev server as same-origin requests:

The page can read the response with fetch, which exposes the compiled source and its inline source maps, module identifiers, the developer's local filesystem…

From nuxt/nuxt's security advisory. Shortened; the full text is there.

Workarounds

  • Use the default Vite builder for development.
  • Use Chrome 142+ or another Chromium-based browser that enforces Local Network Access restrictions, and don't open untrusted sites in other browsers while the dev server is running.
  • If you inline secrets into the client bundle during development, treat them as exposed and rotate them.
Workarounds as given by nuxt/nuxt's security advisory.

Affected software

SoftwareAffected versions
NuxtServers and applications · cna:nuxt|nuxt
  • From 3.0.0 before 4.6.4
NuxtServers and applications · github:nuxt/nuxt
  • From 3.0.0 before 4.0.0
  • From 3.12.2 before 4.0.0
  • From 4.0.0 before 4.6.4

References