CVE-2026-119198— Nuxt dev server arbitrary file read through client error reports

Quick assessment

Affected

nuxt nuxt

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个基于 Vue.js 的开源 Web 开发框架。在版本 4.6.0 至 4.6.3 期间，若攻击者能通过 TCP 访问暴露的 Nuxt 开发服务器，即可通过热模块替换（HMR）套接字发送一条事件，并在消息末尾附加一个绝对文件路径。开发服务器在构建客户端错误报告时会读取该文件，并将其内容通过错误覆盖层（error overlay）、开发错误通道以及终端报告返回，从而绕过了 Vite 的允许列表。由于默认绑定为 localhost，限制了远程暴露；跨域浏览器请求会被拒绝；生产构建版本和 Nuxt 3

CVSS 5.9 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1083 · File and Directory Discovery T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nuxt dev server arbitrary file read through client error reports

Source: CVE Program / CVE List V5

Vulnerability Description

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that file while building the client error report and returns its contents through the error overlay, development error channel, and terminal report, bypassing Vite's server.fs allow list. The default localhost binding limits remote exposure, cross-origin browser requests are rejected, production builds and Nuxt 3 are not affected, and no browser interaction is required. This issue is fixed in version 4.6.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

文件名或路径的外部可控制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nuxt	nuxt	>= 4.6.0, < 4.6.3	-

II. Public POCs for CVE-2026-119198

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119198

请登录查看更多情报信息。

Other References for CVE-2026-119198 (4)

https://github.com/nuxt/nuxt/releases/tag/v4.6.3 x_refsource_MISC
https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3 x_refsource_MISC
https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119198

Same Patch Batch · nuxt · 2026-10-29 · 4 CVEs total

CVE-2026-119200	6.5 MEDIUM	Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server r
CVE-2026-119199	5.9 MEDIUM	Nuxt dev server exposes private runtime config through the Nitro dev bundle
CVE-2026-119201	4.8 MEDIUM	Nuxt dev server exposes generated appSecret through Vite file serving

IV. Related Vulnerabilities

Same product: nuxt

Same vendor: nuxt

Same weakness: CWE-73