Server Exposure Vulnerability in Nuxt Web Development Framework by Nuxt Inc.

CVE-2026-119199

What is CVE-2026-119199?

The Nuxt development server, ranging from versions 3.0.0 to 4.6.3, is susceptible to exposing sensitive runtime configuration values through the Nitro 2 development bundle. This exposure occurs when accessing the server over HTTP, allowing potentially unauthorized access to private secrets within the application's configuration. The vulnerability arises as the development bundle inlines certain runtimeConfig parameters that should remain confidential, particularly values set in the nuxt.config file. However, this risk is mitigated under the default localhost binding, meaning remote accessibility is limited. It’s notable that production builds and builds using Nitro 3 are not subject to this issue, and developers relying solely on NUXT_* environment variables for runtime configuration are not affected. This vulnerability was resolved in version 4.6.3.

References