CVE-2026-128070
Awaiting Analysis Awaiting Analysis - Queue

Nuxt Framework Directory Traversal in Development Server

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspace file above it, or a parent pnpm or Deno settings file that does not declare packages or a workspace, including when the project is inside a Git repository. When the development server is reachable from an untrusted network, Vite permits /_nuxt/@fs/ requests beneath that widened directory, allowing unauthenticated clients to read files such as credentials and SSH keys. The issue affects the development server only; production builds and projects whose parent directories contain no qualifying files are unaffected. This issue is fixed in version 4.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128070
EUVD
EUVD-2026-125594

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nuxt nuxt From 3.5.0 (inc) to 4.6.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nuxt versions 3.5.0 to 4.6.4 have a flaw where the development server may expose files outside the intended project directory. This happens if a parent directory contains certain lockfiles or settings files without proper workspace declarations. An attacker on the same network could access sensitive files like credentials or SSH keys via unauthenticated requests to /_nuxt/@fs/ paths.

Detection Guidance

Check if your Nuxt version is between 3.5.0 and 4.6.4. Run 'npx nuxt --version' to verify. Inspect network traffic for /_nuxt/@fs/ requests accessing sensitive files like credentials or SSH keys.

Impact Analysis

If you use an affected Nuxt version and your project is in a directory with a parent lockfile or settings file, an attacker on your network could read sensitive files. This includes credentials, SSH keys, or other confidential data stored in parent directories. Production builds and projects without qualifying parent files are not affected.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Exposure of credentials or personal data may result in compliance breaches, fines, or legal consequences depending on the data involved.

Mitigation Strategies

Upgrade Nuxt to version 4.6.4 or later. If using a Git repository, ensure no stray parent lockfiles exist. Restrict development server access to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...