CVE-2026-119199 nuxt CVE debrief

Who should care

Defenders responsible for Nuxt development environments, especially those handling sensitive data, should assess exposure and prioritize remediation. This includes verifying if development environments using Nuxt 3 or Nuxt 4 with Nitro 2 are exposed to unauthorized access and checking if private runtime config values are being exposed through the Nitro development server bundle.

Why it matters

CVE-2026-119199 exposes private runtime config values in Nuxt development environments using Nitro 2, requiring defenders to verify and remediate potential exposure.

• Potential exposure of sensitive data in development environments
• Possible unauthorized access to private runtime config values
• Need for verification of development environment security
• Priority for updating or patching vulnerable Nuxt versions

Technical summary

The Nitro development server bundle written by `nuxt dev` can be fetched through the Vite dev server, exposing private runtime config values that were resolved at build time. This vulnerability affects Nuxt 3 and Nuxt 4 environments using Nitro 2. The bundle is served by the dev server and contains every private (non-`public`) runtime config value that was resolved at build time, including values set in `nuxt.config`. Defenders should prioritize verifying and remediating this vulnerability in development environments, especially where sensitive data is handled.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in development environments, especially where sensitive data is handled.

Recommended defensive actions

• Verify if development environments using Nuxt 3 or Nuxt 4 with Nitro 2 are exposed to unauthorized access.
• Check if private runtime config values are being exposed through the Nitro development server bundle.
• Remediate by updating to a fixed version or applying compensating controls to restrict access to the dev server.
• Monitor for suspicious access to the dev server and review config values for potential exposure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The source corpus provides details on how the Nitro development server bundle can be fetched through the Vite dev server, exposing private runtime config values. The bundle is served by the dev server and contains every private (non-`public`) runtime config value that was resolved at build time. This includes values set in `nuxt.config`, such as a secret read from `.env`. Exploitation requires HTTP access to the dev server, and defenders should verify and remediate potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.