{"id":"CVE-2026-49993","title":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","summary":"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)","severity":"medium","cwe":["CWE-749"],"vendor":"nuxt","product":"@nuxt/webpack-builder","ecosystem":"npm","affected":["@nuxt/webpack-builder >= 4.0.0, < 4.4.7","@nuxt/webpack-builder >= 3.15.4, < 3.21.7","@nuxt/rspack-builder >= 4.0.0, < 4.4.7","@nuxt/rspack-builder >= 3.15.4, < 3.21.7"],"patched":["@nuxt/webpack-builder 4.4.7","@nuxt/webpack-builder 3.21.7","@nuxt/rspack-builder 4.4.7","@nuxt/rspack-builder 3.21.7"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x6qj-4h56-5rj5","references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49993"},{"url":"https://github.com/nuxt/nuxt/pull/35200"},{"url":"https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05"},{"url":"https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3"},{"url":"https://github.com/advisories/GHSA-x6qj-4h56-5rj5"}],"tags":["ghsa","npm"],"epss":0.0028,"epssPercentile":0.20734,"ingestedAt":"2026-06-29T14:31:47.463Z","slug":"CVE-2026-49993","body":"## Overview\n\n### Summary\nThis is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g). Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network.\n\n### Details\nThe fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) added an `Origin` / `Referer` fallback to the dev-middleware same-origin check, with a `return true` branch when neither header is present so that non-browser clients (curl, the HMR client, address-bar navigation) keep working.\n\nThat fallback is bypassed when a cross-origin attacker request reaches the dev server with all three signal headers absent:\n\n- `Sec-Fetch-Site` is [not sent by browsers to non-potentially-trustworthy destinations](https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-site-header) (HTTP on a non-loopback address).\n- `Origin` is not sent on non-CORS subresource fetches (a bare `\n```\n\n### Impact\nUsers using the webpack / rspack builder with `nuxt dev --host` may get the built source code read by malicious websites on the same network, including module identifiers, the developer's local filesystem path, and any developer-controlled strings inlined into the bundle.\n\nThis vulnerability does not affect Chrome 142+ (and other Chromium-based browsers) users due to [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n\nThe default Vite builder is not affected.\n\n### Patches\nFixed in `@nuxt/webpack-builder@4.4.7` / `@nuxt/rspack-builder@4.4.7` and backported to `@nuxt/webpack-builder@3.21.7` / `@nuxt/rspack-builder@3.21.7` by [#35200](https://github.com/nuxt/nuxt/pull/35200) (4.x: commit [`e351de94`](https://github.com/nuxt/nuxt/commit/e351de943e82db16970618b60dc7fdbaa58630f3); 3.x: commit [`77187ee4`](https://github.com/nuxt/nuxt/commit/77187ee4015e9267fb464951542a3e09e8b5fa05)). The dev-middleware same-origin check now treats a request with no `Sec-Fetch-Site`, no `Origin`, and no `Referer` as same-origin only when the dev server is loopback-bound, closing the header-suppression bypass.\n\nThe fix only ships for the `@nuxt/webpack-builder` and `@nuxt/rspack-builder` packages. The default Vite builder was not affected.\n\n### Workarounds\nIf you cannot upgrade immediately:\n\n- Don't use `nuxt dev --host`. Bind the dev server to `localhost` (the default) and tunnel from other devices via SSH or a reverse proxy that enforces same-origin checks.\n- Use Chrome 142+ or another Chromium-based browser that enforces [Local Network Access restrictions](https://developer.chrome.com/release-notes/142#local_network_access_restrictions).\n- Switch to the Vite builder for development.\n\n### Credit\nReported by Berkan SAL ([@Uhudsavasindankacanokcu2](https://github.com/Uhudsavasindankacanokcu2)) via the Vercel Open Source HackerOne program.\n\nIndependently reported by [@DavidCarliez](https://github.com/DavidCarliez) via GitHub's coordinated disclosure flow (`GHSA-xw96-2f5x-v9pv`), closed as a duplicate of this advisory.\n\n## Affected packages\n\n- `@nuxt/webpack-builder >= 4.0.0, < 4.4.7`\n- `@nuxt/webpack-builder >= 3.15.4, < 3.21.7`\n- `@nuxt/rspack-builder >= 4.0.0, < 4.4.7`\n- `@nuxt/rspack-builder >= 3.15.4, < 3.21.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@nuxt/webpack-builder 4.4.7`\n- `@nuxt/webpack-builder 3.21.7`\n- `@nuxt/rspack-builder 4.4.7`\n- `@nuxt/rspack-builder 3.21.7`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}