DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-49993: CVE-2026-49993: Proprietary Source Code Exfiltration via Incomplete Same-Origin Verification in Nuxt Dev Servers

#security #cve #cybersecurity

CVE-2026-49993: Proprietary Source Code Exfiltration via Incomplete Same-Origin Verification in Nuxt Dev Servers

Vulnerability ID: CVE-2026-49993
CVSS Score: 5.7
Published: 2026-06-16

CVE-2026-49993 identifies an incomplete same-origin check validation mechanism in @nuxt/webpack-builder and @nuxt/rspack-builder dev server middleware. When the local development server is bound to a non-loopback address, cross-origin attackers can bypass verification checks by suppressing browser headers, leading to unauthorized retrieval and exfiltration of compiled source code chunks.

TL;DR

Nuxt dev servers bound to non-loopback interfaces allow headerless cross-origin requests, enabling malicious sites to silently exfiltrate proprietary source code from active local development environments.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-749
  • Attack Vector: Adjacent Network
  • CVSS v3.1 Score: 5.7
  • EPSS Score: 0.00201
  • Impact: High Confidentiality Loss
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • @nuxt/webpack-builder
  • @nuxt/rspack-builder
  • @nuxt/webpack-builder: >= 3.15.4, < 3.21.7 (Fixed in: 3.21.7)
  • @nuxt/rspack-builder: >= 3.15.4, < 3.21.7 (Fixed in: 3.21.7)
  • @nuxt/webpack-builder: >= 4.0.0, < 4.4.7 (Fixed in: 4.4.7)
  • @nuxt/rspack-builder: >= 4.0.0, < 4.4.7 (Fixed in: 4.4.7)

Code Analysis

Commit: e351de9

Fix same-origin validation utility loopback check for webpack-builder and rspack-builder

Commit: 77187ee

Ensure strict loopback check implementation within development middleware engines

Mitigation Strategies

  • Restrict development server bindings exclusively to loopback addresses (127.0.0.1 or localhost).
  • Utilize modern web browsers that enforce Local Network Access (LNA) protections.
  • Perform local development activities within isolated browser sessions or profiles.

Remediation Steps:

  1. Open the package management configuration of the Nuxt project.
  2. Execute the update command: pnpm update nuxt or pnpm update @nuxt/webpack-builder @nuxt/rspack-builder.
  3. Verify that dependencies resolve to version 3.21.7 (for Nuxt 3) or 4.4.7 (for Nuxt 4) or higher.
  4. Remove configuration variables that bind the development host to 0.0.0.0 or LAN-visible IPs.

References

Read the full report for CVE-2026-49993 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)