Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119199— Nuxt dev server exposes private runtime config through the Nitro dev bundle

Quick assessment

Affected
nuxt nuxt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个基于 Vue.js 的开源 Web 开发框架。在版本 3.0.0 至 4.6.3 期间，当 Nuxt 开发服务器可通过 HTTP 访问时，Vite 的文件服务功能可能会将 Nitro 2 的开发构建包暴露于 路径下。Nitro 会在构建时将私有的 值内联到该构建包中，这些值包括在 中配置的密钥；从 Nuxt 4.6.0 及更高版本开始，生成的开发环境 也会被内联。默认情况下，服务器仅绑定 localhost，这限制了远程暴露风险；生产构建和 Nitro 3 不受此问题影响；此外，仅在服务器启动时通过

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119199

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt dev server exposes private runtime config through the Nitro dev bundle
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt nuxt >= 3.0.0, < 4.6.3 -

II. Public POCs for CVE-2026-119199

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119199

请登录查看更多情报信息。

Other References for CVE-2026-119199 (3)

Same Patch Batch · nuxt · 2026-10-29 · 4 CVEs total

CVE-2026-119200 6.5 MEDIUM Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server r
CVE-2026-119198 5.9 MEDIUM Nuxt dev server arbitrary file read through client error reports
CVE-2026-119201 4.8 MEDIUM Nuxt dev server exposes generated appSecret through Vite file serving

IV. Related Vulnerabilities

Same product: nuxt
Same vendor: nuxt
Same weakness: CWE-200