CVE-2026-45670: Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

May 19, 2026 (updated July 8, 2026)

This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network.

References

github.com/advisories/GHSA-6m52-m754-pw2g
github.com/nuxt/nuxt/pull/35051
github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99
github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
nvd.nist.gov/vuln/detail/CVE-2026-45670

Code Behaviors & Features

Detect and mitigate CVE-2026-45670 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →