Directory Traversal Vulnerability in Nuxt Web Development Framework
CVE-2026-128070
5.9MEDIUM
What is CVE-2026-128070?
The Nuxt web development framework, ranging from versions 3.5.0 to 4.6.4, contains a directory traversal vulnerability. This allows unauthorized users to access sensitive files such as credentials and SSH keys through the /_nuxt/@fs/ endpoint on the development server when it is exposed to untrusted networks. The vulnerability arises when Nuxt mistakenly selects a parent directory as the default workspace due to specific conditions involving lockfiles and settings files. This issue does not affect production builds or projects without the qualifying files in their parent directories. A fix has been implemented in version 4.6.4.
Affected Version(s)
nuxt >= 3.5.0, < 4.6.4
schema >= 3.5.0, < 4.6.4