Is there a public PoC exploit available for CVE-2026-49993?

Yes, a public proof-of-concept exploit is available for CVE-2026-49993. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-49993?

Yes, a patch is available for CVE-2026-49993. Update the affected software to the latest version immediately.

Nuxt webpack/rspack CVE-2026-49993

Q: What is the CVSS score of CVE-2026-49993?

CVE-2026-49993 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36421 MEDIUM

Exposed Dangerous Method or Function (CWE-749)

2026-06-12 GitHub_M

GHSA-x6qj-4h56-5rj5

Information Disclosure Nuxt

5.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

AV:A because LAN presence is required; AC:H for multi-condition prerequisites (--host flag, developer interaction, triple header suppression); PR:N as attacker needs no credentials; UI:R for required developer action; C:H for full source disclosure; I/A:N as no write or availability impact applies.

3.1 AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:A/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 15:01 EUVD

Source Code Evidence Fetched

Jun 12, 2026 - 14:21 vuln.today

Analysis Generated

Jun 12, 2026 - 14:21 vuln.today

DescriptionCVE.org

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

AnalysisAI

Source code exfiltration in Nuxt's @nuxt/webpack-builder and @nuxt/rspack-builder (versions 3.15.4-3.21.6 and 4.0.0-alpha.1-4.4.6) enables a LAN-adjacent attacker to read a developer's full application source from the webpack dev server when it is bound to a non-loopback address via nuxt dev --host. This is a second incomplete fix in a chain stemming from GHSA-4gf7-ff8x-hq99: the previous patch (GHSA-6m52-m754-pw2g) relied on Sec-Fetch-* metadata headers that browsers silently omit for non-trustworthy (plain HTTP) origins, leaving a bypass when an attacker page strips all three identifying headers (Sec-Fetch-Site, Origin, Referer) simultaneously. A proof-of-concept JavaScript payload is documented in the GHSA advisory; EPSS is very low at 0.02% (7th percentile) and no CISA KEV entry exists, reflecting the narrow exploitation conditions required.

Technical ContextAI

The affected packages (@nuxt/webpack-builder, @nuxt/rspack-builder) expose webpack and rspack dev-server chunk endpoints (e.g., /_nuxt/app.js) during development. The root cause class is CWE-749 (Exposed Dangerous Method or Function): the same-origin guard on these endpoints was bypassable. The prior fix implemented a check using the Sec-Fetch-Site header with an Origin/Referer fallback; when none of those headers were present, the original isSameOriginRequest function returned true (permissive default). Per the W3C Fetch Metadata specification, Sec-Fetch-* headers are only appended by browsers for 'potentially trustworthy' origins - plain HTTP pages on a private network are explicitly excluded. An attacker serving a page over HTTP can therefore suppress Sec-Fetch-Site entirely. Combined with a non-CORS <script> tag (which omits Origin) and Referrer-Policy: no-referrer (which suppresses Referer), all three headers vanish and the old guard admitted the request. The new fix (PR #35200) changes the no-headers fallback to check whether the Host header resolves to a loopback address (localhost, 127.0.0.1, ::1), denying access when the dev server is bound to a LAN interface. CPE: cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade @nuxt/rspack-builder and @nuxt/webpack-builder to the patched version. Per the GHSA advisory, fixed versions are 3.21.6 (v3 series) and 4.4.6 (v4 series); the CVE description references 3.21.7 and 4.4.7 - consult the advisory at https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5 and the upstream fix in PR #35200 (commits 77187ee4 and e351de94) to confirm the exact released version before upgrading. If immediate upgrade is not possible, the most effective compensating control is to avoid running nuxt dev --host - the default localhost-only binding is not vulnerable, and this single change removes the attack surface entirely with no functional trade-off for purely local development. If LAN exposure is required (e.g., testing on physical mobile devices), restrict access to the dev server port via host-based firewall rules or network ACLs to only trusted LAN clients, accepting the operational overhead of managing the allowlist.