CVE-2026-45670
2 advisories.
npm/@nuxt/rspack-builder CVE-2026-45670: medium 5.4, EPSS 0.37%
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
Action: Upgrade @nuxt/rspack-builder to 3.21.6 or later.
npm i @nuxt/rspack-builder@3.21.6npm i @nuxt/rspack-builder@4.4.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.15.4 | 3.21.6 | - |
| 4.0.0-alpha.1 | 4.4.6 | - |
Fixed versions
| 3.21.6 | 4.4.6 |
Sources
- osv: GHSA-6m52-m754-pw2g
- https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
- https://nvd.nist.gov/vuln/detail/CVE-2026-45670
- https://github.com/nuxt/nuxt/pull/35051
- https://github.com/nuxt/nuxt
CVE-2026-45670 · published · modified · JSON
npm/@nuxt/webpack-builder CVE-2026-45670: medium 5.4, EPSS 0.37%
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
Action: Upgrade @nuxt/webpack-builder to 3.21.6 or later.
npm i @nuxt/webpack-builder@3.21.6npm i @nuxt/webpack-builder@4.4.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.15.4 | 3.21.6 | - |
| 4.0.0-alpha.1 | 4.4.6 | - |
Fixed versions
| 3.21.6 | 4.4.6 |
Sources
- osv: GHSA-6m52-m754-pw2g#npm/@nuxt/webpack-builder
- https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
- https://nvd.nist.gov/vuln/detail/CVE-2026-45670
- https://github.com/nuxt/nuxt/pull/35051
- https://github.com/nuxt/nuxt
CVE-2026-45670 · published · modified · JSON