CVE-2025-24360

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite builder may get the source code stolen by malicious websites. Version 3.15.3 fixes the vulnerability.

• CWE-200

• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/client.ts#L257-L263
• https://github.com/nuxt/nuxt/blob/7d345c71462d90187fd09c96c7692f306c90def5/packages/vite/src/vite-node.ts#L39
• https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f
• https://github.com/nuxt/nuxt/pull/23995
• https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47
• https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6

Published

Jan 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24354imgproxy is server for resizing, processing, and converting …5.3
• CVE-2025-24355Updatecli is a tool used to apply file update strategies. Pr…7.1
• CVE-2025-24356fastd is a VPN daemon which tunnels IP packets and Ethernet …7.5
• CVE-2025-24357vLLM is a library for LLM inference and serving. vllm/model_…8.8
• CVE-2025-24358gorilla/csrf provides Cross Site Request Forgery (CSRF) prev…5.4
• CVE-2025-24359ASTEVAL is an evaluator of Python expressions and statements…8.4
• CVE-2025-24361Nuxt is an open-source web development framework for Vue.js.…5.3
• CVE-2025-24362In some circumstances, debug artifacts uploaded by the CodeQ…7.1
• CVE-2025-24363The HL7 FHIR IG publisher is a tool to take a set of inputs …4.2
• CVE-2025-24364vaultwarden is an unofficial Bitwarden compatible server wri…7.2
• CVE-2025-24365vaultwarden is an unofficial Bitwarden compatible server wri…7.5
• CVE-2025-24366SFTPGo is an open source, event-driven file transfer solutio…7.5