CVE-2026-49993: Nuxt Build Tools Source Code Theft in Development Environment

Technical summary

The vulnerability stems from an inadequate fix to GHSA-6m52-m754-pw2g in Nuxt's webpack and rspack build configurations. When the dev server binds to a non-loopback address (0.0.0.0 or a specific network interface rather than localhost), it becomes reachable from other devices on the same network. A malicious website, if visited by the developer, can exploit missing or insufficient origin/referrer validation to make unauthorized requests to the dev server and retrieve source code artifacts. The attack requires user interaction (visiting a malicious site) and network adjacency, but does not require authentication or elevated privileges. Root cause is attributed to CWE-749 (Exposed Dangerous Method or Function).

Business impact

Source code theft during development poses significant intellectual property and security risks. Exposed source code may reveal hardcoded secrets (API keys, tokens), architectural details, and third-party dependencies, accelerating downstream attacks. Teams using Nuxt for proprietary applications or those in regulated industries (fintech, healthcare) face compliance and reputational damage. The impact is confined to dev environments; published/built applications are not affected. However, the prevalence of developers running dev servers on non-localhost addresses—especially in containerized or remote development setups—means many teams are potentially exposed.

Affected systems

Vulnerable: @nuxt/webpack-builder versions 3.15.4 to 3.21.6 (inclusive) and 4.0.0 to 4.4.6 (inclusive). Vulnerable: @nuxt/rspack-builder versions 3.15.4 to 3.21.6 (inclusive) and 4.0.0 to 4.4.6 (inclusive). Patched: versions 3.21.7 and 4.4.7 and later. Affected teams are those using Nuxt v3 or v4 for application development, particularly those running dev servers with --host or equivalent configuration to enable remote access (common in team environments, CI/CD pipelines, and Dockerized development).

Exploitability

Exploitation requires three conditions: (1) developer runs the dev server bound to a network-accessible address; (2) developer visits a malicious website on the same network; (3) the website makes cross-origin requests to the dev server to extract source code. Attack complexity is low and does not require special network position, but does depend on social engineering (tricking the developer to visit a malicious site). CVSS score of 5.7 (MEDIUM) reflects the need for user interaction and local network requirement, offset by high confidentiality impact. The vulnerability is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Immediately upgrade @nuxt/webpack-builder and @nuxt/rspack-builder to versions 3.21.7 (for v3 branch) or 4.4.7 (for v4 branch) or later. These patched versions include a complete fix for the source code exposure issue. For teams unable to upgrade immediately, restrict dev server binding to localhost (127.0.0.1) or ::1 (IPv6 loopback); avoid using --host 0.0.0.0 or --host <network-ip> in development unless absolutely necessary and only on trusted networks. Educate developers about the risks of visiting untrusted websites while running dev servers with network exposure.

Patch guidance

Update your Nuxt project's package.json dependencies: for v3 users, ensure @nuxt/webpack-builder and @nuxt/rspack-builder are at least 3.21.7; for v4 users, ensure they are at least 4.4.7. Run npm install, yarn install, or pnpm install (depending on your package manager) and commit the updated lock file. Verify the installed versions by running npm ls @nuxt/webpack-builder @nuxt/rspack-builder or equivalent. Test your dev build (nuxt dev) to confirm no regressions. Patches are available from the official Nuxt repository and npm registry; verify checksums or GPG signatures if your organization requires them.

Detection guidance

Review package-lock.json, yarn.lock, or pnpm-lock.yaml files to identify current versions of @nuxt/webpack-builder and @nuxt/rspack-builder across your development and CI environments. Use Software Bill of Materials (SBOM) tools or dependency scanners (npm audit, Snyk, Dependabot) to flag vulnerable versions. Monitor dev server logs for unusual cross-origin requests or access patterns from unexpected sources. If you suspect source code has been exfiltrated, audit git history and review what secrets or sensitive information may have been exposed, then rotate any hardcoded credentials. Implement network segmentation to prevent developers from accessing untrusted external networks while their dev servers are active.

Why prioritize this

This is a regression (incomplete patch) affecting a widely-used framework, with moderate exploitability that hinges on developer behavior and network access. Priority should be elevated if your organization uses Nuxt in production development, especially for proprietary or regulated applications. However, the attack requires user interaction and local network proximity, and production applications are not at risk. Patch quickly (within 1-2 weeks for active development teams) but assess for code leakage and rotation of any exposed secrets in parallel.

Risk score, explained

The CVSS 5.7 MEDIUM score reflects: (1) high confidentiality impact (source code theft), (2) no integrity or availability impact, (3) requirement for user interaction and adjacent network access, (4) no authentication needed once server is accessible. The score appropriately penalizes the user-interaction requirement and network adjacency, but rewards the practical exploitability in team/container environments where non-loopback binding is common. Organizations should treat this as higher priority than the numeric score suggests if they have large development teams or CI/CD systems exposed to untrusted networks.

Frequently asked questions