Nuxt’s development server serves the Nitro development bundle at <buildDir>/dev/index.mjs when accessed over HTTP. The bundle contains values from runtimeConfig that are inlined at build time, including secrets set in nuxt.config as well as the automatically generated appSecret in Nuxt 4.6.0 and later. If the dev server is reachable beyond the default localhost binding, an attacker can retrieve these secrets by requesting the bundle, resulting in an unauthorized disclosure of confidential data.

The vulnerability affects Nuxt versions starting from 3.0.0 up to and including 4.6.2. Production builds, Nitro 3, and runtime configuration supplied only via environment variables at startup are not impacted. The issue is fixed in Nuxt 4.6.3.

The CVSS score of 5.9 indicates moderate severity. EPSS information is not available, so the precise exploitation likelihood is uncertain, though the problem is not listed in the CISA KEV catalog. The attack vector is limited to those who can reach the dev server over HTTP; the default localhost binding mitigates remote exposure, but if the server is exposed or the binding is modified, an attacker could exploit the flaw to read sensitive configuration and secrets.