CVE-2025-24360

What it actually does

Nuxt versions 3.8.1 through 3.15.2, when using the Vite builder with the default server.cors configuration, allow cross-origin browser requests to the development server and allow the requesting website to read the response. The flaw does not directly compromise a production Nuxt application by itself; the main risk is to developer workstations or exposed development servers. If a developer has the Nuxt dev server running and visits an attacker-controlled website, that site can use the developer’s browser to request dev-server URLs and retrieve source files, build metadata, routes, configuration fragments, and other development-time artifacts that the dev server exposes. The impact is confidentiality loss; integrity and availability are not the primary effects.

Why it matters to the business

The primary business risk is leakage of proprietary application source code and development artifacts from developer machines or internet-accessible development environments. Exposed code can reveal business logic, unpublished features, API usage patterns, internal endpoints, secrets accidentally committed to the project, or implementation details that make later attacks easier. This issue is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported mature public exploitation in the supplied data; however, it has been public for 561 days, so affected development environments should be considered overdue for remediation.

How an attack unfolds

An attacker first creates or compromises a website that contains JavaScript designed to probe common Nuxt/Vite development-server addresses such as localhost or private-network hosts on typical dev ports. A developer with an affected Nuxt version running locally or in a reachable development environment visits the attacker-controlled page. Because the vulnerable Nuxt dev server permits broad CORS access by default, the malicious page can issue browser-based fetch or XMLHttpRequest calls to the dev server and read the responses instead of being blocked by the browser’s same-origin policy. The attacker’s script enumerates accessible files and framework endpoints, retrieves source code or development artifacts, and then sends the collected data back to attacker infrastructure. Exploitation requires user interaction and a running/reachable development server, which is why the attack complexity is higher than a direct unauthenticated server-side exploit.

How to fix it

Upgrade Nuxt to version 3.15.3 or later. For projects pinned to affected versions, update package manifests and lockfiles, reinstall dependencies, and rebuild development containers or workstations so the fixed Nuxt version is actually used. Avoid exposing Nuxt development servers to untrusted networks; bind dev servers to localhost where possible, restrict listening interfaces, and use firewall rules or VPN controls for shared development environments. If development-server CORS must be enabled, configure it explicitly to allow only trusted origins rather than using permissive defaults. Do not run development servers in production or on publicly reachable hosts. Review repositories for accidentally committed secrets because this vulnerability can turn source-code exposure into credential exposure if secrets are present in the project tree. The supplied package fixed-version list appears to reference unrelated Red Hat Enterprise Linux Python/AppStream packages; for this Nuxt issue, the relevant fixed version is Nuxt 3.15.3 or later.

How to confirm the fix worked

Confirm the installed Nuxt version is 3.15.3 or later using the project package manager and lockfile, for example by checking package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, or npm/yarn/pnpm dependency output. Start the development server in a controlled test environment and send a request with an untrusted Origin header; the response should not grant arbitrary cross-origin read access. Specifically, verify that responses from the dev server do not include permissive CORS behavior such as Access-Control-Allow-Origin reflecting any arbitrary origin or using a wildcard for sensitive dev-server responses. Confirm the dev server is bound only to intended interfaces and is not reachable from the public internet or untrusted network segments. Search asset inventories, container images, CI development images, and developer templates for Nuxt versions from 3.8.1 through 3.15.2.

Typical attack path

1. Attacker hosts a malicious webpage containing JavaScript that probes common Nuxt/Vite development-server URLs and ports.
2. A developer using an affected Nuxt version starts the development server with the default Vite CORS behavior.
3. The developer visits the attacker-controlled webpage while the dev server is running or reachable from the browser.
4. The malicious page sends cross-origin requests from the developer’s browser to the Nuxt development server.
5. The vulnerable dev server returns readable responses because permissive CORS headers allow the malicious origin.
6. The attacker’s script collects source files, route information, module output, or other development artifacts exposed by the dev server.
7. The malicious page exfiltrates the collected data to attacker-controlled infrastructure.

How to detect it

To investigate possible prior exploitation, focus on developer endpoints and shared development hosts rather than production web logs. Review browser history, DNS logs, proxy logs, and EDR network telemetry for visits to suspicious or newly registered external websites while Nuxt development servers were running. Look for browser processes such as Chrome, Edge, Firefox, or Safari making requests to localhost, 127.0.0.1, ::1, or private-network addresses on common Nuxt/Vite development ports, followed by outbound uploads to unrelated external domains. If dev-server request logging is available, search for requests containing unexpected Origin headers, especially origins not associated with the organization or the local development workflow. Examine shell history, terminal logs, container logs, and IDE task logs to determine when nuxt dev or nuxi dev was running. Review network captures or endpoint telemetry for access to Nuxt/Vite-specific paths such as /_nuxt/, /@fs/, /@vite/, and Vite HMR endpoints from browser contexts. If source-code exposure is suspected, rotate any credentials that may exist in the repository or local development files and review external repositories, paste sites, and code-search services for leaked proprietary code fragments.

• Access-Control-Allow-Origin: *
• Origin: http://
• Origin: https://
• /_nuxt/
• /@fs/
• /@vite/
• /__vite_ping
• /__nuxt_vite_node__
• localhost:3000
• 127.0.0.1:3000
• [::1]:3000
• localhost:3001
• 127.0.0.1:3001
• localhost:24678
• 127.0.0.1:24678
• nuxt dev
• nuxi dev
• server.cors

What your security team should do

• Prioritize upgrading all Nuxt projects using versions 3.8.1 through 3.15.2 to Nuxt 3.15.3 or later, especially developer workstations, remote development containers, and shared dev servers.
• Block public or untrusted-network access to Nuxt/Vite development-server ports and require localhost binding or authenticated development gateways.
• Run dependency inventory checks across repositories and development images to identify affected Nuxt versions, including transitive or template-based usage.
• Audit project repositories for committed secrets, environment files, API tokens, private keys, and internal endpoint documentation that could have been exposed through source-code theft.
• Add monitoring for browser processes making requests to localhost or private development-server ports shortly before outbound POST/PUT requests to unfamiliar external domains.
• Educate developers not to browse untrusted websites while sensitive development servers are running and to stop dev servers when not in use.
• Because the issue is not KEV-listed and has low EPSS, treat it as a confidentiality-focused engineering remediation rather than an emergency internet-wide incident, unless development servers are publicly exposed or source code contains secrets.