CVE-2026-128072

LOW

INFO Priority: 0.00 BB Relevance: 46/100

Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network No Auth

CVSS Vector Breakdown

AV: Network

AC: High

PR: None

UI: Required

S: Unchanged

C: Low

I: None

A: None

Description

Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.