{"action":"Upgrade @nuxt/webpack-builder to 3.21.6 or later.","affected":[{"fixed":"3.21.6","introduced":"3.15.4"},{"fixed":"4.4.6","introduced":"4.0.0-alpha.1"}],"component":"@nuxt/webpack-builder","cve_ids":["CVE-2026-45670"],"ecosystem":"npm","epss":0.00205,"exploited":false,"fixed_versions":["3.21.6","4.4.6"],"ghsa_id":"GHSA-6m52-m754-pw2g","id":"tcs_01M5KF7E7VXGX42GD676C4C5HP","modified_at":"2026-07-08T17:45:15.001725956Z","published_at":"2026-05-19T15:51:14Z","references":["https://osv.dev/vulnerability/GHSA-6m52-m754-pw2g","https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99","https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g","https://nvd.nist.gov/vuln/detail/CVE-2026-45670","https://github.com/nuxt/nuxt/pull/35051","https://github.com/nuxt/nuxt"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-6m52-m754-pw2g#npm/@nuxt/webpack-builder","url":"https://osv.dev/vulnerability/GHSA-6m52-m754-pw2g"}],"summary":"Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)"}