{"id":"CVE-2026-119201","aliases":["GHSA-3xf4-9g3c-4h4w"],"title":"Nuxt dev server exposes generated appSecret through Vite file serving","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\n\nWhen no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a development secret and stores it in `<buildDir>/app-secret` (by default `.nuxt/app-secret`). The build directory is inside the directories that Nuxt passes to Vite's `server.fs.allow`, so the file can be fetched from the dev server:\n\n```bash\ncurl http://<dev-server>/_nuxt/@fs/<absolute-path-to-project>/.nuxt/app-secret\n```\n\nAnyone who can read it can compute every secret derived from it with `deriveSecret()`, including the default password used by `useSession`, and so can forge session cookies accepted by that dev server.\n\nExploitation requires direct HTTP access to the dev server. `nuxt dev` listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with `--host`, a published container port or a tunnel). A malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response.\n\nProduction builds never generate an `appSecret` and are not affected. Dev servers with an explicitly configured `appSecret` do not use the generated file.\n\n### Patches\n\nFixed in `@nuxt/vite-builder` 4.6.3, which `nuxt` 4.6.3 depends on. The dev server now adds `app-secret` to Vite's `server.fs.deny`, keeping Vite's default deny list.\n\n### Workarounds\n\nSet `NUXT_APP_SECRET` in `.env` to a random value of at least 32 characters (for example the output of `openssl rand -base64 32`), or avoid exposing the dev server to untrusted networks.\n\nIf a dev server using a generated secret has been reachable by untrusted clients, delete `.nuxt/app-secret` (a new secret is generated on the next `nuxt dev`) or set `NUXT_APP_SECRET`. Either invalidates existing dev sessions.","severity":"medium","score":4.8,"published":"2026-10-29T20:21:27.895Z","modified":"2026-10-30T23:15:04.501Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"@nuxt/vite-builder","sources":[{"name":"OSV · GHSA-3xf4-9g3c-4h4w","url":"https://osv.dev/vulnerability/GHSA-3xf4-9g3c-4h4w"}],"ranges":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}],"type":"SEMVER"}],"versions":[],"fixed":["4.6.3"]}],"sourceAffected":[],"references":["https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w","https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308","https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd","https://github.com/nuxt/nuxt/releases/tag/v4.6.3","https://nvd.nist.gov/vuln/detail/CVE-2026-119201","https://github.com/nuxt/nuxt"],"sources":[{"name":"CVE","id":"CVE-2026-119201","modified":"2026-10-30T16:08:10.079Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119201"},{"name":"OSV","id":"GHSA-3xf4-9g3c-4h4w","modified":"2026-10-30T23:15:04.501043731Z","url":"https://osv.dev/vulnerability/GHSA-3xf4-9g3c-4h4w"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8}],"cve":{"records":[{"id":"CVE-2026-119201","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T16:04:48.728Z","published":"2026-10-29T20:21:27.895Z","modified":"2026-10-30T16:08:10.079Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T20:21:27.895Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T16:08:10.079Z"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-552","description":"CWE-552: Files or Directories Accessible to External Parties","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T15:20:40.211444Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"nuxt","name":"nuxt","platforms":[],"versions":[{"version":">= 4.6.0, < 4.6.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119201"}],"remediation":[],"observedAt":"2026-10-30T23:33:14.776Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:35:32.065Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T21:20:34.790Z","attemptedAt":"2026-10-29T21:20:34.790Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T21:20:34.955Z","attemptedAt":"2026-10-29T21:20:34.955Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T21:20:34.953Z","attemptedAt":"2026-10-29T21:20:34.953Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T21:20:34.235Z","attemptedAt":"2026-10-29T21:20:34.235Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119201","modified":"2026-10-29T21:17:19.077","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T21:20:34.790Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113372","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113372","modified":"Oct 29, 2026, 8:21:27 PM","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-29T21:20:34.953Z"}],"aiSummary":{"text":"Nuxt dev server exposes a generated appSecret through Vite file serving when no appSecret is configured, affecting versions 4.6.0 to 4.6.3. Exploitation requires direct HTTP access to the dev server. A malicious actor can compute secrets derived from the appSecret, including the default password used by useSession.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T01:11:09.293Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119201"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-3xf4-9g3c-4h4w"}]}}