@nuxt/vite-builder
npm4 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @nuxt/vite-builderpage 1 of 1
- CVE-2025-24360MEDIUMCVSS 5.3EG 5.3fixed in 3.15.32025-01-25
Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings.…
- CVE-2026-119198MEDIUMCVSS 5.9EG 5.9fixed in 4.6.32026-10-29
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at th…
- CVE-2026-119199MEDIUMCVSS 5.9EG 5.9fixed in 4.6.32026-10-29
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable o…
- CVE-2026-119201MEDIUMCVSS 4.8EG 4.8fixed in 4.6.32026-10-29
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration.…
Check whether @nuxt/vite-builder is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @nuxt/vite-builder CVEs against the assets you own.
Book a Demo →