Live › vulnerability › CVE-2026-119201
From Nuxt 4.6.0 to 4.6.2, the nuxt dev server writes a generated appSecret file that sits inside a directory Vite serves. A client that can reach an exposed dev server can read that file, derive the default useSession password, and forge session cookies the dev server accepts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Only projects running nuxt dev from Nuxt 4.6.0 through 4.6.2 are at risk, and only when the dev server is reachable over the network and no appSecret is configured explicitly. Production builds are not affected, and the default localhost binding limits remote exposure. Teams using Nuxt only for production builds can skip it.
No product ranges from the sources yet.
npx nuxt --version or the nuxt entry in package.json and package-lock.json..nuxt/app-secret file in the project and confirm whether appSecret is set explicitly in the Nuxt config.nuxt dev is bound to a non-localhost address and reachable from other machines.4.6.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119201")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.