CVE-2026-72744

Nuxt's development server contains an information disclosure flaw (CWE-200) in its Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json), where the local-request gate (isLocalDevRequest) trusts the attacker-supplied Host header rather than the connected peer address. An unauthenticated attacker on the local network can trigger it when the dev server is bound to a network-reachable interface (e.g. via nuxt dev --host) with the default-on experimental.chromeDevtoolsProjectSettings flag, by sending a request with a spoofed Host header and omitting browser headers such as Sec-Fetch-Site, Origin, and Referer. A successful request returns the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID; per the advisory the disclosed data is limited to these two values, with no code execution. Only developers running affected versions (Nuxt 4 >= 4.4.7 and Nuxt 3.21.7 up to but below 3.21.10) in development mode are affected — production builds are unaffected. No in-the-wild exploitation is currently reported (EPSS ~0.1%, not in CISA KEV), but one public proof-of-concept is available.

What to do: Upgrade to Nuxt 4.5.1 or 3.21.10 (or later). Until upgraded, avoid binding the dev server to non-loopback interfaces on untrusted networks (omit nuxt dev --host / keep it on localhost) or disable experimental.chromeDevtoolsProjectSettings, and verify whether any dev servers on affected versions are reachable from shared LANs.