CVE-2026-72744 nuxt CVE debrief

Who should care

Defenders responsible for Nuxt development servers, especially those used in development or testing environments, should assess exposure and apply patches or mitigations. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

CVE-2026-72744 is a medium-severity information disclosure vulnerability affecting Nuxt development servers. Defenders should prioritize verifying exposure, applying patches, and mitigating risks associated with unauthorized LAN access.

• Verify exposure of development servers to unauthorized information disclosure
• Assess and mitigate risks associated with unauthenticated LAN access to development servers
• Prioritize patching or mitigating vulnerable Nuxt development servers
• Verify configuration of Chrome DevTools workspace endpoint and experimental.chromeDevtoolsProjectSettings

Technical summary

The Nuxt development server's Chrome DevTools workspace endpoint contains an information disclosure vulnerability. The endpoint's local-request gate trusts the attacker-supplied Host header rather than the connected peer address. This allows an unauthenticated attacker on the LAN to send a request with a spoofed Host header and retrieve the project's absolute filesystem root path and a persistent per-project workspace UUID.

Defensive priority

Defenders should prioritize verifying exposure of development servers, especially those bound to network-reachable interfaces, and apply patches or mitigations.

Recommended defensive actions

• Verify exposure of Nuxt development servers, especially those bound to network-reachable interfaces
• Apply patches or mitigations, such as upgrading to Nuxt versions 4.5.1 or 3.21.10
• Review and adjust configuration of Chrome DevTools workspace endpoint and experimental.chromeDevtoolsProjectSettings
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. Vendor advisories are available on GitHub and Vulncheck. The vulnerability has a CVSS score of 6.9 and a medium severity. Defenders should verify exposure of development servers, especially those bound to network-reachable interfaces, and apply patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.