CVE-2026-119199: Nuxt dev server exposes private runtime config through the Nitro dev bundle

October 30, 2026

With Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by nuxt dev can be fetched through the Vite dev server. Nitro inlines the resolved runtimeConfig into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.

References

github.com/advisories/GHSA-648h-gw55-m2g7
github.com/nuxt/nuxt/commit/12b58f9d8768682611c3ad4ea4d403875129dbca
github.com/nuxt/nuxt/releases/tag/v4.6.3
github.com/nuxt/nuxt/security/advisories/GHSA-648h-gw55-m2g7
nvd.nist.gov/vuln/detail/CVE-2026-119199

Code Behaviors & Features

Detect and mitigate CVE-2026-119199 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →