The vulnerability lies in Nuxt’s dev server configuration when built with @nuxt/rspack-builder or @nuxt/webpack-builder between version 3.15.4 and before 3.21.6, and between 4.0.0-alpha.1 and before 4.4.6. When the server is bound to a non‑loopback address, an attacker on the same local area network can request the compiled source files exposed by the dev server, enabling theft of potentially confidential code. Although the vulnerability does not provide direct code‑execution capabilities, it represents a moderate confidentiality breach, reflected in a CVSS score of 5.9 and categorized under CWE‑749.

Nuxt is affected. Specifically, the Vue.js development framework vendor identified as nuxt:nuxt, including the @nuxt/rspack-builder and @nuxt/webpack-builder modules. Affected releases are those ranging from 3.15.4 up to (but not including) 3.21.6, and from 4.0.0-alpha.1 up to (but not including) 4.4.6. All versions before the patch contain the incomplete fix for the referenced GHSA issue.

Because the exploit requires an attacker to be on the same local network and the server must be listening on a non‑loopback interface, the risk of exploitation is moderate, reflected by a low EPSS score of less than 1% and absence from the CISA KEV catalog. The CVSS score of 5.9 indicates a medium severity impact for confidentiality. The patch mitigates the exposure by ensuring the dev server does not serve source files over external interfaces.