The vulnerability results from an incomplete fix of a previously known issue (GHSA-6m52-m754-pw2g). In affected Nuxt versions the development server performs a same‑origin check that is bypassed when the Sec‑Fetch‑Site, Origin, and Referer headers are all absent. When a developer runs nuxt dev bound to a non‑loopback address (for example by specifying --host) and a malicious site on the same local network accesses the dev server, the server accepts the request and can serve source code files. This leads to unauthorized disclosure of source code during development, impacting the confidentiality of the application in a non‑production environment. The flaw is classified as CWE‑749, a single‑sign‑on server side authentication bypass.

Nuxt’s @nuxt/webpack-builder and @nuxt/rspack-builder packages from version 3.15.4 to 3.21.6 and from 4.0.0 to 4.4.6 are affected. The issue was fixed in version 3.21.7 and 4.4.7.

The CVSS score of 5.9 indicates a moderate risk, while an EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker who shares the local network with a developer who has bound the nuxt dev server to a non‑loopback interface can launch a malicious webpage that omits the standard origin headers. The dev server will accept the request and may deliver source code files, resulting in source code theft. Because this attack needs local network proximity and a misconfigured dev server, it poses a tangible threat for developers working in open or shared networks but is less relevant to production deployments.