{"action":"Upgrade nuxt to 3.21.10 or later.","affected":[{"fixed":"4.5.1","introduced":"4.4.7"},{"fixed":"3.21.10","introduced":"3.21.7"}],"component":"nuxt","cve_ids":["CVE-2026-72744"],"ecosystem":"npm","epss":0.00181,"exploited":false,"fixed_versions":["4.5.1","3.21.10"],"ghsa_id":"GHSA-7c4v-fwgw-9rf7","id":"tcs_01M5KF9K17V5WSX1NDQHNXPQQ0","modified_at":"2026-08-13T14:30:09.219497646Z","published_at":"2026-08-07T16:45:21Z","references":["https://osv.dev/vulnerability/GHSA-7c4v-fwgw-9rf7","https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7","https://nvd.nist.gov/vuln/detail/CVE-2026-72744","https://github.com/nuxt/nuxt/commit/00f71bb6517abff67257c8ea1fcdc777b938b68d","https://github.com/nuxt/nuxt/commit/e30c611ea03240f341fe784ab1711aa6424da2fa","https://github.com/nuxt/nuxt","https://github.com/nuxt/nuxt/releases/tag/v3.21.10","https://github.com/nuxt/nuxt/releases/tag/v4.5.1","https://www.vulncheck.com/advisories/nuxt-before-information-disclosure-via-chrome-devtools"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-7c4v-fwgw-9rf7","url":"https://osv.dev/vulnerability/GHSA-7c4v-fwgw-9rf7"},{"source":"nvd","source_id":"CVE-2026-72744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72744"}],"summary":"Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint"}