{"action":"Upgrade @nuxt/rspack-builder to 3.21.7 or later.","affected":[{"fixed":"4.4.7","introduced":"4.0.0"},{"fixed":"3.21.7","introduced":"3.15.4"}],"component":"@nuxt/rspack-builder","cve_ids":["CVE-2026-49993"],"ecosystem":"npm","epss":0.00309,"exploited":false,"fixed_versions":["4.4.7","3.21.7"],"ghsa_id":"GHSA-x6qj-4h56-5rj5","id":"tcs_01M5KGH75R6893VG7QJMFT0H0Y","modified_at":"2026-09-10T03:50:12.300274004Z","published_at":"2026-06-16T23:39:16Z","references":["https://osv.dev/vulnerability/GHSA-x6qj-4h56-5rj5","https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g","https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5","https://nvd.nist.gov/vuln/detail/CVE-2026-49993","https://github.com/nuxt/nuxt/pull/35200","https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05","https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3","https://github.com/nuxt/nuxt"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-x6qj-4h56-5rj5#npm/@nuxt/rspack-builder","url":"https://osv.dev/vulnerability/GHSA-x6qj-4h56-5rj5"}],"summary":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)"}