CVE-2026-128072

Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.

• CWE-346

• https://github.com/nuxt/nuxt/commit/3c9645326a2b3f5cfa09c9a935db9b1825d560e7
• https://github.com/nuxt/nuxt/commit/3e1c7964e6843e1c5f218867a4ccd4cd00ad9ebb
• https://github.com/nuxt/nuxt/commit/8c11d965dad5bfc58d4c25e796915aec045acb78
• https://github.com/nuxt/nuxt/commit/f8d64c9aa773a033596532365d455890da9da197
• https://github.com/nuxt/nuxt/releases/tag/v4.6.4
• https://github.com/nuxt/nuxt/security/advisories/GHSA-x2wv-5868-p7v2

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-128067Pillow is a Python imaging library. From 2.3.0 through 12.3.…8.4
• CVE-2026-128068rails-html-sanitizer is responsible for sanitizing HTML frag…5.3
• CVE-2026-128069rails-html-sanitizer is responsible for sanitizing HTML frag…4.7
• CVE-2026-12807A vulnerability was found in Edimax BR-6478AC V2 1.23. This …6.3
• CVE-2026-128070Nuxt is an open-source web development framework for Vue.js.…5.9
• CVE-2026-128071Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128074Nuxt is an open-source web development framework for Vue.js.…6.9
• CVE-2026-128075Nuxt is an open-source web development framework for Vue.js.…5.3
• CVE-2026-128076Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128077Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128078GLPI is a free asset and IT management software package. Fro…5.3
• CVE-2026-128079envd provides reproducible development environments for huma…6.8