Vulnerability Description
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.6 and 4.4.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nuxt | Nuxt\/Rspack-Builder | >= 3.12.2, < 3.21.5 |
| Nuxt | Nuxt\/Webpack-Builder | >= 3.0.0, < 3.21.5 |
Related Weaknesses (CWE)
References
- https://github.com/nuxt/nuxt/pull/35051Issue Tracking
- https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99ExploitVendor Advisory
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploitVendor Advisory
- https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99ExploitVendor Advisory
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploitVendor Advisory
FAQ
What is CVE-2026-45670?
CVE-2026-45670 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomple...
How severe is CVE-2026-45670?
CVE-2026-45670 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45670?
Check the references section above for vendor advisories and patch information. Affected products include: Nuxt Nuxt\/Rspack-Builder, Nuxt Nuxt\/Webpack-Builder.