CVE-2026-72744

Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

No known exploitation. EPSS puts it in the 8th percentile. Fixed in 4.5.1.

CVSS 3.16.2Medium EPSS percentile8th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4.5.1Upgrade to this build

Published 2026-08-11Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

NuxtAffected: ≥ 4.4.7, < 4.5.1Upgrade to: 4.5.1Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check if your developers run nuxt dev --host (binding the dev server to the network) rather than the default localhost-only mode.
If so, confirm you're on a Nuxt version between 4.4.7 and 4.5.1, or 3.21.7 and 3.21.10.
Upgrade to Nuxt 4.5.1 (or 3.21.10 for the 3.x line) to get the fix.
If you can't upgrade immediately, avoid using --host on shared or untrusted networks, or disable experimental.chromeDevtoolsProjectSettings.

npm install nuxt@4.5.1

Usually a quick update

What it is

From the CVE record

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10.

In plain language

Written by AI from the record

This affects developers running Nuxt's local development server exposed to a network, letting someone on the same network peek at the project's file path and a workspace ID — it's not a risk to live production websites, so most businesses don't need to worry.

Information disclosure in Nuxt's dev-server Chrome DevTools workspace endpoint (CWE-200) stems from a Host-header-based local-request check that trusts attacker-supplied headers instead of verifying the actual peer address, letting a LAN-based attacker spoof Host to retrieve the project's absolute filesystem root path and a persistent workspace UUID when the dev server is run with --host and the default experimental.chromeDevtoolsProjectSettings setting enabled.

If you're affected

Developer environment file path exposure
Internal project metadata leak
No impact to production sites

What is it

Nuxt is a tool developers use to build websites, and it includes a local preview/development mode for testing before going live. This bug is like leaving a sticky note with your office's internal floor plan visible to anyone plugged into the same office network — it reveals internal file-path details, not customer or financial data, and only during development, not on your live website.

Who is affected

This matters to you if your development team runs Nuxt projects locally with the nuxt dev --host option, which exposes the development server to your network instead of keeping it on a single machine. It does not affect your finished, published (production) website. The risk only exists if someone else is on the same network as that exposed dev server and sends a crafted request — no login is required for them to try.

How urgent is it

There is no evidence of active exploitation, no listing in the government's known-exploited-vulnerabilities catalog, and no public exploit code circulating. This is a low-urgency issue limited to development environments — fix it during your normal update cycle rather than treating it as an emergency.

What to do — in detail

Confirm exposure by checking whether any Nuxt dev servers are started with --host (binding to 0.0.0.0 or a LAN interface) and whether experimental.chromeDevtoolsProjectSettings is enabled (it is on by default). If both conditions hold, an unauthenticated LAN peer can hit GET /.well-known/appspecific/com.chrome.devtools.json with a spoofed Host header to retrieve rootDir and a workspace UUID. Upgrade to Nuxt 4.5.1 (for the 4.4.7–4.5.1 range) or 3.21.10 (for the 3.21.7–3.21.10 range); no breaking changes are noted for this fix. As a temporary workaround, bind the dev server to localhost only (drop --host) or set experimental.chromeDevtoolsProjectSettings: false in nuxt.config. Production builds are unaffected and require no action. No CISA KEV due date applies since this CVE is not in KEV. Monitor for any future escalation (KEV listing or public PoC) via the vendor advisory, though none exists as of this writing.

Technical context

CVSS 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a local-network attack vector with high confidentiality impact but no integrity or availability loss. Weakness is CWE-200 (information exposure) caused by a flawed local-request authorization check that trusts the client-supplied Host header rather than validating the actual connecting peer. EPSS scores this as very low predicted exploitation likelihood with a flat trend, consistent with the dev-only, network-adjacent nature of the flaw. Not in CISA KEV; no public exploit code or news-confirmed exploitation exists. Fixed in Nuxt 4.5.1 and 3.21.10.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS8th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 8th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 44 days, from the signal feeds we watch.

2026-09-24Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

nuxtoss-projectaka nuxt/framework, nuxt.js
- nuxtLibraryOSS Libraries / web-framework

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 6.2 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact