{"items":[{"id":"NVI-00008865","kind":"vulnerability","title":"Nuxt dev server exposes private runtime config through the Nitro dev bundle","revision":5,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-648h-gw55-m2g7","CVE-2026-119199"],"plain_summary":"GitHub lists this reviewed advisory for @nuxt/vite-builder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-02e3966ee29810454d045d04234ac9b5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.6.3 for @nuxt/vite-builder. Confirm the publisher’s latest guidance.","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:44.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0eb19a9ab90feb94cfa413fac5ac6562"},{"kind":"CVSS","as_of":"2026-10-30T17:18:03.880Z","value":"5.9 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-5ceb73fe66bf610420320ce3d6cca8b4"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.350%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.287. Missing scores are unknown.","source_id":"sr-02e3966ee29810454d045d04234ac9b5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0eb19a9ab90feb94cfa413fac5ac6562","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-b2be98526355afd0f89626dda72c9672","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:56:54.054Z"},{"id":"sr-5ceb73fe66bf610420320ce3d6cca8b4","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119199","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-119199","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:16.598Z"},{"id":"sr-02e3966ee29810454d045d04234ac9b5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119199","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.845Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0eb19a9ab90feb94cfa413fac5ac6562"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":[">= 3.0.0, < 4.6.3"]},{"certainty":"source_listed","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":["SEMVER: introduced 3.0.0; fixed 4.6.3"]}],"null_published_at":"2026-11-07T07:07:42.462Z","source_updated_at":"2026-10-30T23:00:44.000Z","source_disclosed_at":"2026-10-30T23:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00008865","kind":"vulnerability","title":"Nuxt dev server exposes private runtime config through the Nitro dev bundle","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-648h-gw55-m2g7","CVE-2026-119199"],"plain_summary":"GitHub lists this reviewed advisory for @nuxt/vite-builder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-02e3966ee29810454d045d04234ac9b5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.6.3 for @nuxt/vite-builder. Confirm the publisher’s latest guidance.","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:44.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0eb19a9ab90feb94cfa413fac5ac6562"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.350%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.287. Missing scores are unknown.","source_id":"sr-02e3966ee29810454d045d04234ac9b5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0eb19a9ab90feb94cfa413fac5ac6562","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-b2be98526355afd0f89626dda72c9672","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:56:54.054Z"},{"id":"sr-02e3966ee29810454d045d04234ac9b5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119199","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.845Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0eb19a9ab90feb94cfa413fac5ac6562"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":[">= 3.0.0, < 4.6.3"]},{"certainty":"source_listed","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":["SEMVER: introduced 3.0.0; fixed 4.6.3"]}],"null_published_at":"2026-11-03T17:49:14.991Z","source_updated_at":"2026-10-30T23:00:44.000Z","source_disclosed_at":"2026-10-30T23:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00008865","kind":"vulnerability","title":"Nuxt dev server exposes private runtime config through the Nitro dev bundle","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-648h-gw55-m2g7","CVE-2026-119199"],"plain_summary":"GitHub lists this reviewed advisory for @nuxt/vite-builder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-528547b99f15b1915d7e421b94fbf908"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.6.3 for @nuxt/vite-builder. Confirm the publisher’s latest guidance.","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:44.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0eb19a9ab90feb94cfa413fac5ac6562"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.350%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.28713. Missing scores are unknown.","source_id":"sr-528547b99f15b1915d7e421b94fbf908"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0eb19a9ab90feb94cfa413fac5ac6562","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-b2be98526355afd0f89626dda72c9672","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:56:54.054Z"},{"id":"sr-528547b99f15b1915d7e421b94fbf908","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-119199","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.375Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0eb19a9ab90feb94cfa413fac5ac6562"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":[">= 3.0.0, < 4.6.3"]},{"certainty":"source_listed","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":["SEMVER: introduced 3.0.0; fixed 4.6.3"]}],"null_published_at":"2026-11-01T01:04:04.830Z","source_updated_at":"2026-10-30T23:00:44.000Z","source_disclosed_at":"2026-10-30T23:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:55:49.621Z"},{"id":"NVI-00008865","kind":"vulnerability","title":"Nuxt dev server exposes private runtime config through the Nitro dev bundle","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-648h-gw55-m2g7","CVE-2026-119199"],"plain_summary":"GitHub lists this reviewed advisory for @nuxt/vite-builder. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0eb19a9ab90feb94cfa413fac5ac6562"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 4.6.3 for @nuxt/vite-builder. Confirm the publisher’s latest guidance.","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T23:00:44.000Z","value":"5.9 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-0eb19a9ab90feb94cfa413fac5ac6562"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0eb19a9ab90feb94cfa413fac5ac6562","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-b2be98526355afd0f89626dda72c9672","url":"https://github.com/advisories/GHSA-648h-gw55-m2g7","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-648h-gw55-m2g7","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:56:54.054Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0eb19a9ab90feb94cfa413fac5ac6562"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":[">= 3.0.0, < 4.6.3"]},{"certainty":"source_listed","source_ids":["sr-b2be98526355afd0f89626dda72c9672"],"technology":"@nuxt/vite-builder","known_exclusions":[],"conditions_summary":"### Summary\n\nWith Nitro 2 (the default server engine in Nuxt 3 and Nuxt 4), the Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server. Nitro inlines the resolved `runtimeConfig` into that bundle, so private runtime config values that were resolved at build time can be read by anyone with HTTP access to the dev server.\n\n### Impact\n\n`nuxt dev` writes the Nitro development server bundle to `/dev/index.mjs` (by default `.nuxt/dev/index.mjs`). The build directory is inside the directories Nuxt passes to Vite's `server.fs.allow`, so the bundle is served by the dev server:\n\n```bash\ncurl http:///_nuxt/@fs//.nuxt/dev/index.mjs\n```\n\nThe response contains every private (non-`public`) runtime config value that was resolved at build time. That includes values set in `nuxt.config`, such as a secret read from `.env`:\n\n```ts\nexport default defineNuxtConfig({\n  runtimeConfig: {\n    apiSecret: process.env.API_SECRET,\n  },\n})\n```\n\nFrom Nuxt 4.6.0, it also includes the generated development `appSecret`. Vite's default deny list blocks `.env` itself, but not the bundle containing values read from it.\n\nExploitatio","public_affected_ranges":["SEMVER: introduced 3.0.0; fixed 4.6.3"]}],"null_published_at":"2026-10-31T22:13:31.311Z","source_updated_at":"2026-10-30T23:00:44.000Z","source_disclosed_at":"2026-10-30T23:00:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:55:49.621Z"}],"next_cursor":null,"snapshot_revision":"42594"}