CVE-2026-119199

Nuxt dev server exposes private runtime config through the Nitro dev bundle

State: Published
Severity: 5.9 Medium
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 29, 2026

Description

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Affected Products

Product	Versions
nuxtnuxt	>= 3.0.0, < 4.6.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.