EUVD-2026-113369Published
Nuxt dev server arbitrary file read through client error reports
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-119198 · CVE overview and exploitation status
cve-program · CVE-2026-119198
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c
- https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3
- https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3
euvd · EUVD-2026-113369
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c
- https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3
- https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3
nvd · CVE-2026-119198
- https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3
- https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c
osv · GHSA-x287-wcfc-q46c
- https://github.com/nuxt/nuxt/security/advisories/GHSA-x287-wcfc-q46c
- https://nvd.nist.gov/vuln/detail/CVE-2026-119198
- https://github.com/nuxt/nuxt/commit/35856eb148bf8d6f1ad753c5b8b337c52b4fd6b3
- https://github.com/nuxt/nuxt/commit/aec8129f68e9b870ca919f8f60e65a4608c8a6d8
- https://github.com/nuxt/nuxt
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3
Related changes
Linked by CVE identifier- Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the… · Advisory content revised · 1 Nov 2026
- Nuxt dev server arbitrary file read through client error reports · Newly collected advisory · 30 Oct 2026
- Nuxt dev server arbitrary file read through client error reports · Newly collected advisory · 29 Oct 2026