CVE-2026-49993
2 advisories.
npm/@nuxt/webpack-builder CVE-2026-49993: medium, EPSS 0.31%
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Action: Upgrade @nuxt/webpack-builder to 3.21.7 or later.
npm i @nuxt/webpack-builder@4.4.7npm i @nuxt/webpack-builder@3.21.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.4.7 | - |
| 3.15.4 | 3.21.7 | - |
Fixed versions
| 4.4.7 | 3.21.7 |
Sources
- osv: GHSA-x6qj-4h56-5rj5
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5
- https://nvd.nist.gov/vuln/detail/CVE-2026-49993
- https://github.com/nuxt/nuxt/pull/35200
- https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05
- https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3
- https://github.com/nuxt/nuxt
CVE-2026-49993 · published · modified · JSON
npm/@nuxt/rspack-builder CVE-2026-49993: medium, EPSS 0.31%
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
Action: Upgrade @nuxt/rspack-builder to 3.21.7 or later.
npm i @nuxt/rspack-builder@4.4.7npm i @nuxt/rspack-builder@3.21.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.4.7 | - |
| 3.15.4 | 3.21.7 | - |
Fixed versions
| 4.4.7 | 3.21.7 |
Sources
- osv: GHSA-x6qj-4h56-5rj5#npm/@nuxt/rspack-builder
- https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5
- https://nvd.nist.gov/vuln/detail/CVE-2026-49993
- https://github.com/nuxt/nuxt/pull/35200
- https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05
- https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3
- https://github.com/nuxt/nuxt
CVE-2026-49993 · published · modified · JSON