CVE-2026-119198 · GHSA-x287-wcfc-q46c
Nuxt dev server arbitrary file read through client error reports
- Risk score
- 40/100
- CVSS
- 5.9 v3.1
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the …
- Affected
- @nuxt/vite-builder (npm) >= 4.6.0, < 4.6.3
- Fix
- Upgrade @nuxt/vite-builder to 4.6.3 or later.
- Exploitation
- No known exploitation
Story map
At a glance
@nuxt/vite-builder: Yellow, plan it in. Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the …
The flaws
- CVE-2026-119198: Nuxt dev server arbitrary file read through client error reports (CVSS 5.9)
- CVE-2026-119199: Nuxt dev server exposes private runtime config through the Nitro dev bundle (CVSS 5.9)
The fix
Upgrade @nuxt/vite-builder: 4.6.3 or later on your release line
Who is exposed: @nuxt/vite-builder (npm) >= 4.6.0, < 4.6.3
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-73 (CWE-73). 71 other warnings in 30 days
Why it is Yellow
- CVSS 5.9 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| @nuxt/vite-builder | npm | >= 4.6.0, < 4.6.3 | 4.6.3 |
References
- https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3
- https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c
- https://github.com/advisories/GHSA-x287-wcfc-q46c
- https://nvd.nist.gov/vuln/detail/CVE-2026-119198
- https://github.com/advisories/GHSA-x287-wcfc-q46c
Original description
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.
Last activity 30 Oct 2026. Patch Forecast updates every hour.