5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-49993

CVE-2026-49993: @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. nuxt dev --host) and the developer opens a malicious site on the same network. This issue has been patched in versions 3.21.7 and 4.4.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-49993

CVE-2026-49993:

5.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@nuxt/webpack-builder	npm	>= 4.0.0, < 4.4.7	4.4.7
@nuxt/webpack-builder	npm	>= 3.15.4, < 3.21.7	3.21.7
@nuxt/rspack-builder	npm	>= 4.0.0, < 4.4.7	4.4.7
@nuxt/rspack-builder	npm	>= 3.15.4, < 3.21.7	3.21.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a bypass of the same-origin policy check in the Nuxt development server middleware used by @nuxt/webpack-builder and @nuxt/rspack-builder. The analysis of the provided patches (commits e351de94 and 77187ee4) reveals the root cause.

The patches show that a function named isSameOriginRequest was removed from packages/webpack/src/webpack.ts and replaced with a more secure implementation in a new file, packages/webpack/src/utils/same-origin.ts.

The vulnerable implementation of isSameOriginRequest contained a critical flaw. If a request was received without an Origin or Referer header, the function would immediately return true, effectively trusting the request as being from a same-origin source. The vulnerability description details how an attacker can construct a cross-origin request (e.g., using a <script> tag with referrerpolicy="no-referrer" from a non-trustworthy origin) that arrives at the dev server without any Sec-Fetch-Site, Origin, or Referer headers.

The vulnerable function would process this header-deficient request and incorrectly permit it, leading to source code leakage.

The patch rectifies this by changing the logic. The new implementation, when faced with the same scenario (no Origin or Referer), no longer defaults to true. Instead, it checks if the server is bound to a loopback address (localhost, 127.0.0.1, etc.). Access is only granted if the host is a loopback address, effectively closing the loophole that allowed attacks over a local network when using --host.

Vulnerable functions

isSameOriginRequest

packages/webpack/src/webpack.ts

The vulnerability existed in the `isSameOriginRequest` function located in `packages/webpack/src/webpack.ts`. This function incorrectly defaulted to returning `true` when the `Origin` and `Referer` headers were absent from a request. An attacker could exploit this by making a request from a malicious page that intentionally suppresses these headers, causing the function to incorrectly authorize the request as same-origin. This bypass allowed the attacker to access sensitive source code from the development server if it was exposed on a local network.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.