CVE-2026-72744
Received Received - Intake

Information Disclosure in Nuxt.js Development Server

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72744
EUVD
EUVD-2026-56134

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nuxt nuxt From 3.21.7 (inc) to 3.21.10 (exc)
nuxt nuxt From 4.4.7 (inc) to 4.5.1 (exc)
nuxt nuxt 4.5.1
nuxt nuxt 3.21.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nuxt development servers in versions between 4.4.7 and 4.5.0 or between 3.21.7 and 3.21.9. It allows unauthenticated attackers on the local network to access sensitive information through a flawed security check in the Chrome DevTools workspace endpoint. The endpoint incorrectly trusts the Host header instead of verifying the actual peer address, enabling attackers to spoof requests and retrieve the project's filesystem root path and a persistent workspace UUID.

Detection Guidance

To detect this vulnerability, check if your Nuxt development server is running on a network-reachable interface (not just localhost) and if the experimental.chromeDevtoolsProjectSettings option is enabled. You can test by sending a crafted request with a spoofed Host header to the endpoint /.well-known/appspecific/com.chrome.devtools.json and checking if it returns sensitive filesystem paths or a workspace UUID.

Impact Analysis

If you are using an affected Nuxt version with the development server bound to a network-reachable interface, an attacker on your local network could exploit this to learn the absolute path to your project files and a unique identifier for your workspace. This information could be used to aid further attacks, such as targeted exploits or reconnaissance, but does not directly allow code execution or data modification.

Compliance Impact

This vulnerability may impact compliance by exposing filesystem paths and project structure, which could be considered sensitive information under GDPR or HIPAA if it reveals personally identifiable information or protected health data paths. Unauthorized access to such details could lead to violations of confidentiality requirements, though the vulnerability itself does not directly expose regulated data.

Mitigation Strategies

Immediately upgrade Nuxt to versions 4.5.1 or 3.21.10 or later. As a temporary workaround, bind the dev server only to localhost (e.g., nuxt dev --host 127.0.0.1) or disable the Chrome DevTools workspace endpoint by setting experimental.chromeDevtoolsProjectSettings to false.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart