CVE-2026-56301

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7

Description When running the development server on Linux, the vite-node IPC (Inter-Process Communication) server binds to an abstract-namespace Unix socket without permission restrictions. This allows local users to enumerate and connect to the socket. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files, such as .env and SSH keys, through the SSR (Server-Side Rendering) plugin pipeline. Production builds are not affected because the IPC server only operates during development.

Recommendations Update to version 4.4.7 or later. Update to version 3.21.7 or later.