CVE-2026-49993

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

• CWE-749

• https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05Patch
• https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3Patch
• https://github.com/nuxt/nuxt/pull/35200Issue Tracking
• https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploit, Mitigation, Patch, Vendor Advisory
• https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5Exploit, Mitigation, Patch, Vendor Advisory
• https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2gExploit, Mitigation, Patch, Vendor Advisory
• https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5Exploit, Mitigation, Patch, Vendor Advisory

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49987Repomix is a tool that packs repositories into AI-friendly f…8.8
• CVE-2026-49988Repomix is a tool that packs repositories into AI-friendly f…5.5
• CVE-2026-49989CrateDB is a distributed SQL database. Prior to versions 6.2…7.1
• CVE-2026-4999A security vulnerability has been detected in z-9527 admin u…6.3
• CVE-2026-49991RustFS is a distributed object storage system built in Rust.…8.6
• CVE-2026-49992Kimai is an open-source time tracking application. Versions …6.3
• CVE-2026-49995Tautulli is a Python based monitoring and tracking tool for …4.8
• CVE-2026-49996SecureDrop Client is a desktop app for journalists to secure…3.7
• CVE-2026-49997SurrealDB is a scalable, distributed, collaborative, documen…5.4
• CVE-2026-49998Centrifugo is an open-source scalable real-time messaging se…8.2
• CVE-2026-5000A vulnerability was detected in PromtEngineer localGPT up to…7.3
• CVE-2026-50003A malicious or compromised server can make a DCMTK client us…9.8