---
id: "GHSA-x2wv-5868-p7v2"
page: "https://infrastack.ai/live/GHSA-x2wv-5868-p7v2"
kind: "vulnerability"
aliases: ["GHSA-x2wv-5868-p7v2"]
title: "@nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@nuxt/webpack-builder", "fixed": ["4.6.4"], "affected": ">= 4.0.0, < 4.6.4", "ecosystem": "npm"}, {"name": "@nuxt/webpack-builder", "fixed": [], "affected": ">= 3.0.0, < 4.0.0", "ecosystem": "npm"}, {"name": "@nuxt/rspack-builder", "fixed": ["4.6.4"], "affected": ">= 4.0.0, < 4.6.4", "ecosystem": "npm"}, {"name": "@nuxt/rspack-builder", "fixed": [], "affected": ">= 3.12.2, < 4.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-346", "local-dev", "npm", "nuxt", "package", "rspack", "webpack"]
not_affected_if: ["production-only", "static-export", "vite-builder"]
published_at: "2026-11-02T20:56:22+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:58:22+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# @nuxt/webpack-builder and @nuxt/rspack-builder dev server serves built source to DNS rebinding pages

Link for people: https://infrastack.ai/live/GHSA-x2wv-5868-p7v2 (this .md is for agents)

When Nuxt's webpack or rspack builder runs in dev mode, a malicious page opened in the browser can use DNS rebinding to fetch the built client JavaScript from the dev server. An attacker can read the app's compiled source, source maps, local file paths and any values inlined into the client bundle.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@nuxt/webpack-builder affected >= 4.0.0, < 4.6.4 fixed 4.6.4
- npm:@nuxt/webpack-builder affected >= 3.0.0, < 4.0.0 fixed no fixed version listed
- npm:@nuxt/rspack-builder affected >= 4.0.0, < 4.6.4 fixed 4.6.4
- npm:@nuxt/rspack-builder affected >= 3.12.2, < 4.0.0 fixed no fixed version listed

## How to check

- Check the installed version with `npm ls @nuxt/webpack-builder @nuxt/rspack-builder`.
- Check whether `nuxt.config` sets `builder: 'webpack'` or `builder: 'rspack'` (the default `vite` builder is not affected).
- Check whether the dev server is reached through another hostname, such as a reverse proxy.

## Fix

- `@nuxt/webpack-builder` 4.6.4 and later within 4.x
- `@nuxt/rspack-builder` 4.6.4 and later within 4.x
- Nuxt 3 (webpack-builder 3.x and rspack-builder 3.x) has reached end of life and will not receive a fix.

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2

## From the sources

### Summary

When using the webpack or rspack builder, the dev server serves built client chunks to any request whose `Host` header matches its `Origin`/`Referer`, or that carries `Sec-Fetch-Site: same-origin`. After a DNS rebinding attack both headers name the attacker's hostname, so a malicious page opened while `nuxt dev` is running can read `/_nuxt/*.js` and exfiltrate the app's source. This bypasses the same-origin check added for [GHSA-4gf7-ff8x-hq99](https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99), [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) and [GHSA-x6qj-4h56-5rj5](https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5).

### Impact

A developer runs `nuxt dev` with `builder: 'webpack'` or `builder: 'rspack'` (the default config is enough; `--host` is not required) and opens a page on an attacker-controlled hostname, for example `http://rebind.attacker.example:3000/`. The attacker then re-points that hostname at `127.0.0.1`. Requests from the page now reach the dev server as same-origin requests:

```bash
curl -H 'Host: rebind.attacker.example:3000' -H 'Sec-Fetch-Site: same-origin' http://127.0.0.1:3000/_nuxt/app.js
# 200, with the compiled modules
```

The page can read the response with `fetch`, which exposes the compiled source and its inline source maps, module identifiers, the developer's local filesystem paths, and any developer-controlled values inlined into the client bundle (for example through a custom `DefinePlugin`). With rspack, the HMR websocket also accepts connections from the rebound hostname. Private `runtimeConfig` is not part of the client bundle.

The attacker needs to know or guess the dev server port and to time the DNS change. Chrome 142+ and other Chromium-based browsers that enforce [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions) prompt before a public page can reach a loopback address.

The default Vite builder is not affected: Vite rejects unknown `Host` headers through `server.allowedHosts`. Production builds are not affected.

### Patches

Fixed in `@nuxt/webpack-builder` 4.6.4 and `@nuxt/rspack-builder` 4.6.4. The dev middleware now rejects requests whose `Host` header is not `localhost`, `*.localhost`, an IP address, or a hostname allowed by the new `devServer.allowedHosts` option or by `vite.server.allowedHosts`, before any `Sec-Fetch-Site`/`Origin`/`Referer` checks. This includes `devServer.host` and the hosts `nuxt dev` allows for the addresses it listens on; `nuxt dev --public` allows any host, as it does with Vite. With rspack, the same list is passed to rsbuild's `server.allowedHosts`, which covers the HMR websocket.

If you reach the dev server through another hostname, for example through a reverse proxy, add it to `devServer.allowedHosts` (a leading `.` also allows subdomains, `true` allows any host).

Nuxt 3 has reached end of life and will not receive a fix.

### Workarounds

- Use the default Vite builder for development.
- Use Chrome 142+ or another Chromium-based browser that enforces Local Network Access restrictions, and don't open untrusted sites in other browsers while the dev server is running.
- If you inline secrets into the client bundle during development, treat them as exposed and rotate them.

### Credits

Thanks to Anthropic for reporting this through coordinated disclosure (ANT-2026-VKRM97G5).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_