File Path Exposure in Nuxt Framework by Nuxt

CVE-2026-119198

What is CVE-2026-119198?

The Nuxt framework, an open-source web development tool for Vue.js, has a vulnerability affecting versions 4.6.0 to 4.6.3. This flaw allows an attacker with TCP access to an exposed Nuxt development server to send a nuxt:dev:client-error event over the Hot Module Replacement (HMR) socket, potentially including an absolute file path. Consequently, the development server can read contents of this file when generating a client error report. This information can be disclosed through the error overlay and terminal report, circumventing Vite's server.fs allow list. Although the localhost binding restricts remote exposure, this issue raises significant security concerns, particularly in development environments. Users are encouraged to update to version 4.6.3 or later where this vulnerability has been addressed.

References