World-Connectable IPC Socket Vulnerability in Nuxt Package
Summary
GHSA-2x6f-57hp-86fx: Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux. Affects nuxt versions >= 4.0.0, < 4.4.7. Fixed in 4.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuxt is a popular open-source framework for building server-side rendered applications using Vue.js. It simplifies the development process by providing a robust set of features such as automatic code splitting, server-side rendering, and static site generation. However, certain versions of Nuxt have a vulnerability that exposes the vite-node IPC server on Linux systems, allowing unauthorized local users to access sensitive files.
Vulnerability Detail
The vulnerability arises in Nuxt versions 4.0.0 to 4.4.6 and 3.18.0 to 3.21.6, where the development server binds the vite-node IPC server to an abstract-namespace Unix socket without proper permission restrictions. This allows unprivileged co-resident users to connect to the IPC server and exploit the unprotected module request handler, potentially leading to unauthorized access to sensitive files such as .env files and SSH keys. The vulnerability is classified with a CVSS score of 5.5, indicating a moderate severity level.
How To Fix
Latest published version: 4.6.2 as of 22 Oct 2026
npm install nuxt@4.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.7
This is the first release that contains the fix.
npm install nuxt@4.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the development server by using firewall rules or by running the development server in a more secure environment where unauthorized users do not have access.
Conclusion
The Nuxt package has a vulnerability that allows unauthorized local users to connect to the vite-node IPC server on Linux systems, potentially leading to unauthorized access to sensitive files. It is crucial to update to the latest patched versions to mitigate this risk.
See every vulnerability recorded for nuxt →
FAQ
Nuxt versions 4.0.0 to 4.4.6 and 3.18.0 to 3.21.6 are affected by this vulnerability.
Local users can potentially access sensitive files such as .env files and SSH keys.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability has a CVSS score of 5.5, indicating a moderate severity level.
No, this vulnerability only affects the development server. Production builds are not impacted.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt.
