A client that can reach the Nuxt development server over TCP can trigger a nuxt:dev:client-error event on the HMR socket and supply an absolute filesystem path. The development server then reads that file when constructing an error report and forwards its contents through the error overlay, development error channel and terminal, effectively bypassing Vite’s server.fs allow list. This flow enables arbitrary file reads on the server filesystem. The vulnerability is a form of absolute path traversal (CWE-73) and does not require any browser interaction, so it can be exploited by a network attacker who controls the transport to the dev server.

Nuxt 4.6.0 through 4.6.3 are affected. Nuxt 4.6.3 and later, Nuxt 3, and production builds use a different error reporting path and are not impacted. The default configuration binds the dev server to localhost, which limits exposure, but if the server is exposed beyond localhost or reconfigured to accept external connections, the risk becomes active.

The CVSS score of 5.9 indicates a moderate severity. No EPSS value is provided, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires TCP access to the dev server, which means the risk is higher once the developer machine or CI environment is exposed to an untrusted network. Because the attack vector is network based, it is easier to automate once the vulnerability is discovered. Immediate patching or restricting network exposure mitigates the risk.