CVE-2025-24361: Nuxt.js XSS Vulnerability

CVE-2025-24361 Overview

CVE-2025-24361 affects Nuxt, an open-source web development framework for Vue.js. The vulnerability enables source code disclosure during development when a developer visits a malicious website while running the Nuxt dev server. Affected versions include 3.0.0 through 3.15.12 of the webpack builder and 3.12.2 through 3.15.2 of the rspack builder. Because classic script requests via <script> tags are not subject to the same-origin policy, an attacker can load the victim's local dev bundle cross-origin and extract source code using Function.prototype.toString against values in window.webpackChunknuxt_app. Nuxt 3.15.13 patches the issue [CWE-749].

Critical Impact
An attacker-controlled website can exfiltrate the source code of any Nuxt application running locally in development mode on a visiting developer's machine.

Affected Products

Nuxt 3.0.0 through 3.15.12 (webpack builder)
Nuxt 3.12.2 through 3.15.2 (rspack builder)
Nuxt applications running in development mode

Discovery Timeline

2025-01-25 - CVE-2025-24361 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24361

Vulnerability Analysis

The vulnerability is an Exposed Dangerous Method or Function [CWE-749] in the Nuxt development server. During development, Nuxt's webpack and rspack builders serve JavaScript chunks that register themselves on the global object as window.webpackChunknuxt_app. This global array holds module factory functions that contain the original source of every module in the application.

The dev server did not restrict cross-origin access to these script resources. A <script src> tag loaded from an attacker-controlled origin bypasses the same-origin policy because classic script inclusion is a legacy exception. Once the script executes in the attacker's page, the attacker gains direct references to the module factory functions.

Calling Function.prototype.toString() on each factory returns its full JavaScript source, including proprietary business logic, internal API paths, and any secrets embedded during compilation. Impact is limited to developer workstations actively running nuxt dev.

Root Cause

The Nuxt dev server did not configure Cross-Origin Resource Sharing (CORS) restrictions on responses served by the webpack and rspack dev middleware. Combined with webpack's exposure of module factories through the global window.webpackChunknuxt_app array, any origin could load and introspect the application bundle.

Attack Vector

Exploitation requires the victim to run nuxt dev locally and visit a malicious page while the dev server is reachable. The attack proceeds as follows:

The victim starts the Nuxt dev server, typically on http://localhost:3000.
The victim visits an attacker-controlled site in the same browser session.
The attacker page injects <script src="http://localhost:3000/_nuxt/..."> to load Nuxt bundle chunks.
The attacker script iterates over window.webpackChunknuxt_app and invokes Function.prototype.toString() on each module factory.
Extracted source is exfiltrated to an attacker-controlled endpoint.

The patch introduces a CORS allow-list limited to loopback origins in packages/schema/src/config/dev.ts:

typescript

     * @type {(data: { loading?: string }) => string}
     */
    loadingTemplate,
+
+    /**
+     * Set CORS options for the dev server
+     * @type {typeof import('h3').H3CorsOptions}
+     */
+    cors: {
+      origin: [/^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/],
+    },
  },
})

Source: Nuxt commit 7eeb910

A companion change in packages/vite/src/client.ts migrates from manual CORS header appending to h3's handleCors helper to enforce the allow-list on every request.

Detection Methods for CVE-2025-24361

Indicators of Compromise

Outbound HTTP requests from developer browsers containing large base64 or URL-encoded payloads to unknown domains shortly after visiting new websites
Unexpected cross-origin <script> loads targeting localhost:3000 or other dev-server ports in browser network logs
Requests to /_nuxt/ paths originating from Referer headers pointing to external, non-development domains

Detection Strategies

Inspect Nuxt dev server access logs for requests where the Origin or Referer header is not a loopback address
Monitor developer endpoints for browser processes making bursty POST requests to external domains while nuxt dev is running
Search proxy or DNS telemetry for developer workstations connecting to newly registered domains during active development sessions

Monitoring Recommendations

Enforce egress filtering on developer workstations to block unclassified destinations from receiving large POST payloads
Deploy browser policies that block loopback address access from public origins where feasible
Alert on Nuxt versions below 3.15.13 in dependency inventories generated from CI or SBOM tooling

How to Mitigate CVE-2025-24361

Immediate Actions Required

Upgrade Nuxt to version 3.15.13 or later across all development environments
Audit package.json and lockfiles for Nuxt versions in the vulnerable range 3.0.0 through 3.15.12 (webpack) or 3.12.2 through 3.15.2 (rspack)
Restart any running nuxt dev processes after upgrading to load the patched middleware

Patch Information

The fix is available in Nuxt 3.15.13. Details are documented in GitHub Security Advisory GHSA-4gf7-ff8x-hq99 and delivered via commit 7eeb910. The patch adds a default CORS origin allow-list restricted to localhost, 127.0.0.1, and [::1], and reworks the Vite dev client to use h3's handleCors for consistent enforcement.

Workarounds

Bind the Nuxt dev server to a non-routable interface and use browser profiles dedicated to development that do not visit untrusted sites
Place a reverse proxy in front of the dev server that rejects requests lacking a loopback Origin header
Use Vite builder in development mode instead of the affected webpack or rspack builders until upgrade is possible

bash

# Upgrade Nuxt to the patched version
npm install nuxt@^3.15.13

# Verify installed version
npx nuxt info | grep -i nuxt