CVE-2026-71319
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Nuxt before 3.3.1 in development mode exposes an unauthenticated RPC channel over the Vite HMR WebSocket. An attacker who can reach the HMR port can call methods like updateOptions() and openInEditor(), allowing arbitrary program execution on the developer's machine.
Risk Assessment
Risk of taking over the developer's machine, potentially leading to data theft, malicious code injection, or privilege escalation in the development environment.
Recommendation
Update Nuxt to version 3.3.1 or later. Restrict access to the HMR port to trusted networks only.
Other vulnerabilities in Nuxt
See all- CVE-2026-72744Medium
Information disclosure vulnerability in Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10. The Chrome DevTools workspace endpoint in the development server trusts the Host header instead of the peer address, allowing an unauthenticated LAN attacker to retrieve the project's root directory path and a workspace UUID.
- CVE-2026-71321High
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71320High
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71318Medium
Nuxt, an open-source web development framework for Vue.js, from version 3.1.0 until 3.21.10 and 4.5.1, allows an attacker to supply a top-level 'as' prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71316High
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.
- CVE-2026-71315High
Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71314High
Nuxt, an open-source web development framework for Vue.js, contains a vulnerability allowing an unauthenticated attacker to trigger unbounded SSR memory allocation via the v-for prop in server islands, potentially crashing the Nuxt process. Affects versions from 3.1.0 to 3.21.10 and 4.5.1; fixed in 3.21.10 and 4.5.1.
- CVE-2026-56301Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect.
- CVE-2026-56698Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin.
- CVE-2026-56697Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function. These paths pass the script-protocol check but resolve to a cross-origin URL against the current page protocol.
Original NVD description (English source)
Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://<host>:<port>/, subprotocol vite-hmr) can call RPC methods, with no token, handshake, or origin check before the channel is established. The updateOptions(), clearOptions(), and openInEditor() methods do not enforce the ensureDevAuthToken check that the other mutating methods use. openInEditor() reads the persisted behavior.openInEditor value and passes it to the launch-editor package, which spawns it as a child process. That value is settable through the equally unauthenticated updateOptions(). An attacker who can reach the HMR port can therefore chain updateOptions('behavior', { openInEditor: '<command>' }) then openInEditor('<any-existing-file>') to execute an arbitrary program on the developer's machine. This issue is fixed in 3.3.1.