Answer in brief
CVE-2026-72744 records a Low severity (CVSS 6.2) vulnerability in Nuxt before 4.5.1 Information Disclosure via Chrome DevTools. The current sources do not mark it as known exploited. The current feed maps nuxt/nuxt (generic), nuxt/nuxt (generic), nuxt (npm), nuxt (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nuxt/nuxt (generic), nuxt/nuxt (generic), nuxt (npm), nuxt (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nuxt/nuxtgeneric | >=4.4.7 <4.5.1 | 4.5.1 |
| nuxt/nuxtgeneric | >=3.21.7 <3.21.10 | 3.21.10 |
| nuxtnpm | >=3.21.7 <3.21.10 | 3.21.10 |
| nuxtnpm | >=4.4.7,<4.5.1 | 4.5.1 |
| nuxtnpm | >=3.21.7,<3.21.10 | 3.21.10 |
| nuxtnpm | >=4.4.7 <4.5.1 | 4.5.1 |
Published upstream
Aug 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-specific headers (Sec-Fetch-Site, Origin, Referer) to retrieve the project's absolute filesystem root path (rootDir) and a persistent per-project workspace UUID. Production builds are unaffected. Fixed in 4.5.1 and 3.21.10.
Quoted source text, attributed separately from HOL analysis.