{"action":"Upgrade @nuxt/webpack-builder to 3.21.7 or later.","affected":[{"fixed":"4.4.7","introduced":"4.0.0"},{"fixed":"3.21.7","introduced":"3.15.4"}],"component":"@nuxt/webpack-builder","cve_ids":["CVE-2026-49993"],"ecosystem":"npm","epss":0.0028,"exploited":false,"fixed_versions":["4.4.7","3.21.7"],"ghsa_id":"GHSA-x6qj-4h56-5rj5","id":"tcs_01M5KGH6YWJNYN4HPR7Z5PQ4DJ","modified_at":"2026-09-10T03:50:12.300274004Z","published_at":"2026-06-16T23:39:16Z","references":["https://osv.dev/vulnerability/GHSA-x6qj-4h56-5rj5","https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g","https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5","https://nvd.nist.gov/vuln/detail/CVE-2026-49993","https://github.com/nuxt/nuxt/pull/35200","https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05","https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3","https://github.com/nuxt/nuxt"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-x6qj-4h56-5rj5","url":"https://osv.dev/vulnerability/GHSA-x6qj-4h56-5rj5"},{"source":"nvd","source_id":"CVE-2026-49993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49993"}],"summary":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)"}