Information Disclosure in Nuxt Development Server by NuxtJS

CVE-2026-72744

What is CVE-2026-72744?

Nuxt versions 4.4.7 to 4.5.0 and 3.21.7 to 3.21.9 contain a vulnerability in the development server that allows an unauthenticated attacker on the local network to exploit a flaw in the handling of the Host header. By sending a specially crafted request without required browser-specific headers, an attacker can gain access to sensitive information, including the project's filesystem root path and workspace UUID. This flaw is particularly concerning when the development server is bound to a network-accessible interface and the experimental chromeDevtoolsProjectSettings are enabled, resulting in unpermitted access to critical project data. Users are advised to upgrade to versions 4.5.1 and 3.21.10 to mitigate this risk.

References