CVE-2026-72744: Nuxt Information Disclosure Vulnerability

CVE-2026-72744 Overview

CVE-2026-72744 is an information disclosure vulnerability [CWE-200] in the Nuxt development server. The flaw resides in the Chrome DevTools workspace endpoint at GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate, isLocalDevRequest, trusts the attacker-supplied Host header instead of validating the connected peer address. When developers bind the dev server to a network-reachable interface via nuxt dev --host with experimental.chromeDevtoolsProjectSettings enabled, an unauthenticated attacker on the LAN can retrieve the project's absolute filesystem rootDir path and a persistent per-project workspace UUID. Production builds are unaffected.

Critical Impact
Unauthenticated LAN attackers can extract the absolute filesystem path and a persistent workspace identifier from any exposed Nuxt development server, aiding reconnaissance for follow-on attacks.

Affected Products

Nuxt versions >= 4.4.7 and < 4.5.1
Nuxt versions >= 3.21.7 and < 3.21.10
Nuxt development server with experimental.chromeDevtoolsProjectSettings enabled (default)

Discovery Timeline

2026-08-11 - CVE-2026-72744 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72744

Vulnerability Analysis

The vulnerability lives in Nuxt's development-mode integration with Chrome DevTools workspaces. Nuxt exposes a metadata endpoint at /.well-known/appspecific/com.chrome.devtools.json that returns the project's absolute root directory and a persistent workspace UUID. The endpoint is intended to be reachable only from a local browser during development.

To enforce that constraint, Nuxt applies a filter named isLocalDevRequest. The filter inspects HTTP headers rather than the TCP peer address of the connection. Specifically, it trusts the client-supplied Host header and the absence of browser-set headers such as Sec-Fetch-Site, Origin, and Referer. Attackers control every one of these values.

Because the workspace endpoint returns filesystem paths, it leaks information useful for path-based attacks, template injection, or targeted exploitation of other dev-server routes. The per-project UUID also enables tracking of a specific developer's environment across time.

Root Cause

The root cause is an improper trust boundary in the request authorization logic. isLocalDevRequest derives locality from mutable request headers instead of the socket's remote address. Any header-based gate on unauthenticated endpoints is bypassable by any client that can reach the listening interface.

Attack Vector

Exploitation requires network reachability to a Nuxt dev server bound with nuxt dev --host. The attacker sends a crafted HTTP GET request to the com.chrome.devtools.json endpoint. The request carries a spoofed Host header pointing to localhost and omits Sec-Fetch-Site, Origin, and Referer headers. The dev server responds with the JSON payload containing rootDir and the workspace UUID. See the GitHub Security Advisory GHSA-7c4v-fwgw-9rf7 for the full technical breakdown.

Detection Methods for CVE-2026-72744

Indicators of Compromise

HTTP GET requests to /.well-known/appspecific/com.chrome.devtools.json from non-loopback source addresses.
Requests to the DevTools endpoint that lack Sec-Fetch-Site, Origin, and Referer headers while presenting Host: localhost or Host: 127.0.0.1.
Nuxt dev server processes bound to 0.0.0.0 or LAN-facing interfaces on developer workstations or shared build hosts.

Detection Strategies

Inspect web-server or reverse-proxy access logs for requests to the DevTools workspace path originating from LAN peers.
Correlate Host header contents with the TCP source IP; mismatches on dev-server ports indicate spoofing attempts.
Alert on any external connection reaching TCP ports commonly used by nuxt dev (default 3000) on developer subnets.

Monitoring Recommendations

Enable process and network telemetry on developer endpoints running nuxt to capture bind addresses and inbound peers.
Forward dev-server logs to a centralized SIEM for retention and pattern matching against the endpoint path.
Baseline expected sources of DevTools endpoint access and alert on deviation.

How to Mitigate CVE-2026-72744

Immediate Actions Required

Upgrade Nuxt to version 4.5.1 (for the 4.x branch) or 3.21.10 (for the 3.x branch).
Audit developer machines and CI runners for Nuxt dev servers bound to non-loopback interfaces.
Restrict developer network segments so dev-server ports are not reachable from untrusted LAN peers.

Patch Information

Nuxt maintainers fixed the issue in versions 4.5.1 and 3.21.10. The patched isLocalDevRequest now validates the connected peer address instead of relying on client-controlled headers. Details are published in the GitHub Security Advisory GHSA-7c4v-fwgw-9rf7 and the VulnCheck Advisory.

Workarounds

Bind the Nuxt dev server to localhost only by omitting the --host flag or setting --host 127.0.0.1.
Disable the experimental feature by setting experimental.chromeDevtoolsProjectSettings: false in nuxt.config.ts.
Enforce host firewall rules that block inbound connections to dev-server ports from non-loopback sources.

bash

# Configuration example - disable the vulnerable feature in nuxt.config.ts
export default defineNuxtConfig({
  experimental: {
    chromeDevtoolsProjectSettings: false
  }
})

# Or run the dev server bound only to loopback
npx nuxt dev --host 127.0.0.1