CVE-2026-119201— Nuxt dev server exposes generated appSecret through Vite file serving

Quick assessment

Affected

nuxt nuxt

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个基于 Vue.js 的开源 Web 开发框架。在版本 4.6.0 至 4.6.3 期间，Nuxt 的开发环境会将生成的存储于构建目录（，默认为）中，而该目录位于 Vite 的配置所允许的范围内。若攻击者能够直接通过 HTTP 访问暴露的开发服务器，即可下载该文件，利用函数计算出派生密钥（例如默认的密码），进而伪造可被该开发服务器接受的会话 Cookie。默认情况下，服务仅绑定到 localhost，限制了远程暴露；跨域浏览器读取也被阻止；此外，生产构建以及明确配置了的开发服务器不受此问

CVSS 4.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1552 · Unsecured Credentials T1021 · Remote Services T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nuxt dev server exposes generated appSecret through Vite file serving

Source: CVE Program / CVE List V5

Vulnerability Description

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对外部实体的文件或目录可访问

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nuxt	nuxt	>= 4.6.0, < 4.6.3	-

II. Public POCs for CVE-2026-119201

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119201

请登录查看更多情报信息。

Other References for CVE-2026-119201 (4)

https://github.com/nuxt/nuxt/releases/tag/v4.6.3 x_refsource_MISC
https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd x_refsource_MISC
https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119201

Same Patch Batch · nuxt · 2026-10-29 · 4 CVEs total

CVE-2026-119200	6.5 MEDIUM	Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server r
CVE-2026-119198	5.9 MEDIUM	Nuxt dev server arbitrary file read through client error reports
CVE-2026-119199	5.9 MEDIUM	Nuxt dev server exposes private runtime config through the Nitro dev bundle

IV. Related Vulnerabilities

Same product: nuxt

Same vendor: nuxt

Same weakness: CWE-552