{"id":"GHSA-3xf4-9g3c-4h4w","summary":"Nuxt dev server exposes generated appSecret through Vite file serving","details":"### Impact\n\nWhen no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a development secret and stores it in `\u003cbuildDir\u003e/app-secret` (by default `.nuxt/app-secret`). The build directory is inside the directories that Nuxt passes to Vite's `server.fs.allow`, so the file can be fetched from the dev server:\n\n```bash\ncurl http://\u003cdev-server\u003e/_nuxt/@fs/\u003cabsolute-path-to-project\u003e/.nuxt/app-secret\n```\n\nAnyone who can read it can compute every secret derived from it with `deriveSecret()`, including the default password used by `useSession`, and so can forge session cookies accepted by that dev server.\n\nExploitation requires direct HTTP access to the dev server. `nuxt dev` listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with `--host`, a published container port or a tunnel). A malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response.\n\nProduction builds never generate an `appSecret` and are not affected. Dev servers with an explicitly configured `appSecret` do not use the generated file.\n\n### Patches\n\nFixed in `@nuxt/vite-builder` 4.6.3, which `nuxt` 4.6.3 depends on. The dev server now adds `app-secret` to Vite's `server.fs.deny`, keeping Vite's default deny list.\n\n### Workarounds\n\nSet `NUXT_APP_SECRET` in `.env` to a random value of at least 32 characters (for example the output of `openssl rand -base64 32`), or avoid exposing the dev server to untrusted networks.\n\nIf a dev server using a generated secret has been reachable by untrusted clients, delete `.nuxt/app-secret` (a new secret is generated on the next `nuxt dev`) or set `NUXT_APP_SECRET`. Either invalidates existing dev sessions.","aliases":["CVE-2026-119201"],"modified":"2026-10-30T23:15:04.501043731Z","published":"2026-10-30T23:01:12Z","database_specific":{"github_reviewed_at":"2026-10-30T23:01:12Z","nvd_published_at":"2026-10-29T21:17:19Z","cwe_ids":["CWE-552"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119201"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd"},{"type":"PACKAGE","url":"https://github.com/nuxt/nuxt"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3"}],"affected":[{"package":{"name":"@nuxt/vite-builder","ecosystem":"npm","purl":"pkg:npm/%40nuxt/vite-builder"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3xf4-9g3c-4h4w/GHSA-3xf4-9g3c-4h4w.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}