CVE-2026-45670

Name of the Vulnerable Software and Affected Versions @nuxt/rspack-builder versions 3.15.4 through 3.21.5 @nuxt/rspack-builder versions 4.0.0-alpha.1 through 4.4.5 @nuxt/webpack-builder versions 3.15.4 through 3.21.5 @nuxt/webpack-builder versions 4.0.0-alpha.1 through 4.4.5

Description An incomplete fix in the webpack and rspack builders allows source code to be stolen during development. This occurs if the development server is bound to a non-loopback address (for example, by using nuxt dev --host) and a developer visits a malicious website on the same network. The issue stems from a reliance on Sec-Fetch-Mode and Sec-Fetch-Site headers, which browsers only send for potentially trustworthy origins, allowing the check to be bypassed for non-trustworthy origins.

Recommendations Update @nuxt/rspack-builder versions 3.15.4 through 3.21.5 to version 3.21.6. Update @nuxt/rspack-builder versions 4.0.0-alpha.1 through 4.4.5 to version 4.4.6. Update @nuxt/webpack-builder versions 3.15.4 through 3.21.5 to version 3.21.6. Update @nuxt/webpack-builder versions 4.0.0-alpha.1 through 4.4.5 to version 4.4.6. Avoid using the nuxt dev --host command and bind the development server to localhost. Switch to the Vite builder for development.