Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
This is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. Details The fix for GHSA-6m52-m754-pw2g added an Origin / Referer fallback to the dev-middleware same-origin check, with a return true branch when neither header is present so that non-browser clients (curl, the HMR client, address-bar navigation) keep working. That fallback is bypassed when a cross-origin attacker request reaches the dev server with all three signal headers absent: - Sec-Fetch-Site is not sent by browsers to non-potentially-trustworthy destinations (HTTP on a non-loopback address). - Origin is not sent on non-CORS subresource fetches (a bare <script with no crossorigin). - Referer can be suppressed by the attacker page with <meta name="referrer" content="no-referrer" or…
Recommended action: Upgrade to 4.4.7 or 3.21.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. Details The fix for GHSA-4gf7-ff8x-hq99 relied on Sec-Fetch-Mode and Sec-Fetch-Site headers. Because these headers are sent by the browsers only for potentially trustworthy origins, the check is able to bypass for non-potentially trustworthy origins. Since the attack requires the website to be accessible via a non-potentially trustworthy origin, only apps that are using --host is affected. PoC 1. Create a nuxt project with webpack / rspack builder. 1. Run npm run dev 1. Open http://localhost:3000 1. Run the script below in a web site that has a different origin. 1. You can see the source code output in the document and the devtools console. (This script is the similar with GHSA-4gf7-ff8x-hq99 except for the…
Recommended action: Upgrade to 4.4.6 or 3.21.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject <script src="http://localhost:3000/nuxt/app.js" in their site and run the script. By using Function::toString against the values in window.webpackChunknuxtapp, the attacker can get the source code. PoC 1. Create a nuxt project with webpack / rspack builder. 1. Run npm run dev 1. Open http://localhost:3000 1. Run the script below in a web site that has a different origin. 1. You can see the source code output in the document and the devtools console. It contains the compiled source code and also the source map (but it seems the sourcemap contains transformed content in the sourcesContent field). Impact Users using webpack / rspack builder may get the source code stolen by malicious websites.
Recommended action: Upgrade to 3.15.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.