CVE-2025-24360: Nuxt.js CORS Information Disclosure Flaw

CVE-2025-24360 Overview

CVE-2025-24360 is an information disclosure vulnerability in Nuxt, an open-source web development framework for Vue.js. The flaw affects Nuxt versions 3.8.1 through 3.15.2 when using the Vite builder with default server.cors settings. The permissive default CORS configuration allows any website to send cross-origin requests to a developer's local Nuxt dev server and read the responses. A malicious site visited by a developer can exfiltrate application source code served by the Vite development server. Nuxt released version 3.15.3 to fix the issue.

Critical Impact
Malicious websites can read arbitrary responses from a developer's running Nuxt dev server, leading to source code theft [CWE-200].

Affected Products

Nuxt versions 3.8.1 through 3.15.2
Nuxt projects using the Vite builder with default server.cors configuration
Local development environments running the Nuxt dev server

Discovery Timeline

2025-01-25 - CVE-2025-24360 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24360

Vulnerability Analysis

The vulnerability stems from Nuxt's Vite integration using an overly permissive Cross-Origin Resource Sharing (CORS) policy on the local development server. When a developer runs nuxt dev, the Vite-backed server accepts requests from any origin and returns responses that include CORS headers permitting cross-origin reads. Any website loaded in the developer's browser can issue fetch requests to localhost on the dev server port and receive the response body. This exposes transformed source modules, unbundled files, and the Vite virtual endpoints used by the framework.

The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires user interaction — the developer must visit a malicious page while their dev server is running — which explains the network-based but high-complexity attack profile.

Root Cause

The root cause is the absence of an origin allowlist in the Vite dev server configuration shipped by Nuxt. The client and vite-node handlers in packages/vite/src/client.ts and packages/vite/src/vite-node.ts unconditionally appended CORS headers to responses. No check restricted responses to trusted local origins such as localhost, 127.0.0.1, or [::1].

Attack Vector

An attacker hosts a webpage that issues fetch requests to well-known Nuxt/Vite dev server endpoints on http://localhost:3000 or similar ports. When a developer with an active Nuxt dev session visits the page, the browser sends the requests, the dev server responds with permissive CORS headers, and the attacker's JavaScript reads the responses. Retrieved content can include application source, environment-derived strings embedded in modules, and internal route data.

typescript

// Patch: packages/schema/src/config/dev.ts
// Restrict CORS to local origins by default
     * @type {(data: { loading?: string }) => string}
     */
    loadingTemplate,
+
+    /**
+     * Set CORS options for the dev server
+     * @type {typeof import('h3').H3CorsOptions}
+     */
+    cors: {
+      origin: [/^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/],
+    },
  },
})
// Source: https://github.com/nuxt/nuxt/commit/7eeb910bf4accb1e0193b9178c746f06ad3dd88f

The patch introduces a default cors.origin allowlist matching only localhost, 127.0.0.1, and [::1]. A second change in packages/vite/src/client.ts replaces unconditional appendCorsHeaders calls with handleCors from h3, which honors the configured origin policy.

Detection Methods for CVE-2025-24360

Indicators of Compromise

Unexpected cross-origin fetch requests to localhost dev server ports (default 3000) originating from third-party websites in browser network logs.
Nuxt dev server access logs showing requests with Origin headers pointing to external domains rather than localhost.
Requests targeting Vite-specific paths such as /@vite/client, /@id/, /@fs/, or /_nuxt/ from non-local origins.

Detection Strategies

Inventory Nuxt projects and identify versions between 3.8.1 and 3.15.2 that rely on the default server.cors configuration.
Review browser DevTools network logs on developer workstations for outbound requests to localhost initiated by unrelated web pages.
Enable verbose logging on the Nuxt dev server and alert on requests where the Origin header does not match a local development host.

Monitoring Recommendations

Monitor developer endpoints for browser processes issuing fetch calls to localhost from unexpected parent origins.
Track outbound DNS and HTTP telemetry from developer machines to identify visits to newly registered or low-reputation domains during active nuxt dev sessions.
Log and retain Vite dev server access logs during development to support post-incident review if source code exposure is suspected.

How to Mitigate CVE-2025-24360

Immediate Actions Required

Upgrade all Nuxt projects to version 3.15.3 or later, which ships a restrictive default CORS policy.
Restart any running nuxt dev sessions after upgrading to apply the new CORS configuration.
Instruct developers to avoid browsing untrusted sites in the same browser profile used while the Nuxt dev server is running.

Patch Information

The fix is delivered in Nuxt 3.15.3 via commit 7eeb910. It sets a default cors.origin allowlist limited to localhost, 127.0.0.1, and [::1], and routes CORS handling through the handleCors helper from h3. Additional detail is available in the GitHub Security Advisory GHSA-2452-6xj8-jh47 and the related Vite advisory GHSA-vg6x-rcgg-rjx6.

Workarounds

Explicitly configure vite.server.cors.origin in nuxt.config.ts to an allowlist of trusted local origins if upgrading is not immediately possible.
Bind the dev server to a loopback interface only and avoid exposing it to other network hosts.
Use a dedicated browser profile with no untrusted tabs open while running the Nuxt development server.

bash

# nuxt.config.ts — manual CORS restriction for Vite dev server
export default defineNuxtConfig({
  vite: {
    server: {
      cors: {
        origin: [
          /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/,
        ],
      },
    },
  },
})