Sensitive Data Exposure in Nuxt.js Framework by Vendor Nuxt
CVE-2026-119201
4.8MEDIUM
What is CVE-2026-119201?
The Nuxt.js framework versions 4.6.0 through 4.6.3 contain a vulnerability wherein the development server may inadvertently expose sensitive data. Specifically, the appSecret is generated and stored in /app-secret, typically located at .nuxt/app-secret. This scenario creates a risk where clients with direct access to the exposed development server can retrieve this file, thereby leveraging functions like deriveSecret() to deduce derived secrets including the default useSession password. Such unauthorized access could lead to the forging of session cookies accepted by vulnerable development servers. The issue is mitigated in version 4.6.3, which addresses the exposure.
Affected Version(s)
nuxt >= 4.6.0, < 4.6.3