Is there a patch available for CVE-2026-72744?

Yes, a patch is available for CVE-2026-72744. Update the affected software to the latest version immediately.

Nuxt CVE-2026-72744

Q: What is the CVSS score of CVE-2026-72744?

CVE-2026-72744 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of Nuxt are affected by CVE-2026-72744?

Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the…. A patch is available.

EUVD-2026-56134 MEDIUM

Information Exposure (CWE-200)

2026-08-11 VulnCheck

GHSA-4jjw-pwvw-q6w3

GHSA-7c4v-fwgw-9rf7

Information Disclosure Google Nuxt

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

AV:A for LAN-adjacent reach; AC:H for non-default server binding prerequisite; C:L since only path and UUID are disclosed, not file contents.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 12:46 vuln.today

Analysis Generated

Aug 11, 2026 - 12:46 vuln.today

CVE Published

Aug 11, 2026 - 12:16 cve.org

MEDIUM 6.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on nuxt (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.4.7.

DescriptionCVE.org

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10.

AnalysisAI

Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.

Technical ContextAI

Nuxt is a Vue.js meta-framework distributed via npm (CPE: cpe:2.3:a:nuxt:nuxt). In development mode, versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10 register a development-only HTTP handler for GET /.well-known/appspecific/com.chrome.devtools.json that returns the workspace root directory path and a persistent UUID for Chrome DevTools workspace auto-mapping. The root cause (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) is the flawed isLocalDevRequest gate: rather than inspecting the TCP socket's remote peer address - which cannot be spoofed - it evaluates HTTP request headers (Host, Origin, Referer, Sec-Fetch-Site) that are fully attacker-controlled. A non-browser HTTP client naturally sends none of the browser-specific security headers, causing the gate to incorrectly classify the request as local. This class of vulnerability - trusting mutable metadata in place of immutable network-layer identity - is a well-documented Server-Side Request Forgery / same-origin bypass pattern applied to a host-allowlist check.

RemediationAI

Vendor-released patches are available: upgrade to nuxt@4.5.1 (for the v4 branch) or nuxt@3.21.10 (for the v3 branch). The fix verifies the connected TCP peer is a loopback address by inspecting the socket rather than request headers, making header spoofing ineffective regardless of Host, Origin, Referer, or Sec-Fetch-* values. Full advisory and patch details are at https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7, with commits at https://github.com/nuxt/nuxt/commit/00f71bb6517abff67257c8ea1fcdc777b938b68d and https://github.com/nuxt/nuxt/commit/e30c611ea03240f341fe784ab1711aa6424da2fa. If immediate patching is not possible, two targeted workarounds are available: first, avoid binding the dev server to a non-loopback interface on untrusted networks - omitting the --host flag (or equivalent nuxt.config network binding) reverts the server to loopback-only and fully eliminates the attack surface, with no functional trade-off except loss of on-device LAN testing; second, set experimental.chromeDevtoolsProjectSettings: false in nuxt.config to disable the Chrome DevTools workspace feature entirely, which removes the vulnerable endpoint at the cost of losing Chrome DevTools workspace auto-mapping. A network-layer firewall rule blocking external access to the dev port (default 3000) is an additional compensating control where configuration changes are infeasible.