Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.6 and 4.4.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-45670 Source Code Disclosure in Nuxt Rspack and Webpack Builder Dev Server https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45670
Post summary
The post indicates a source code disclosure for Nuxt Rspack and Webpack Builder Dev Server related to CVE-2026-45670, but provides no PoC, exploit, patch, or detailed technical details.
CVE-2026-45670 Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to … https://www.cve.org/CVERecord?id=CVE-2026-45670
Post summary
The post announces the existence of CVE-2026-45670, providing affected packages and version ranges, but offers no PoC, exploit code, active exploitation evidence, or patch details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | nuxt | nuxt\/rspack-builder | - | node.js | - |
| App | nuxt | nuxt\/webpack-builder | - | node.js | - |