---
id: CVE-2026-119201
aliases:
  - GHSA-3xf4-9g3c-4h4w
title: Nuxt dev server exposes generated appSecret through Vite file serving
summary: Nuxt dev server exposes generated appSecret through Vite file serving
severity: medium
cvss: 4.8
cwe:
  - CWE-552
vendor: nuxt
product: '@nuxt/vite-builder'
ecosystem: npm
affected:
  - '@nuxt/vite-builder >= 4.6.0, < 4.6.3'
patched:
  - '@nuxt/vite-builder 4.6.3'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T23:01:13Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-3xf4-9g3c-4h4w'
references:
  - url: 'https://github.com/nuxt/nuxt/security/advisories/GHSA-3xf4-9g3c-4h4w'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-119201'
  - url: >-
      https://github.com/nuxt/nuxt/commit/2981290f36d9c5412c022758f3d89ba21a845308
  - url: >-
      https://github.com/nuxt/nuxt/commit/545004cc350be7003dea4116ce6206d6f980b1fd
  - url: 'https://github.com/nuxt/nuxt/releases/tag/v4.6.3'
  - url: 'https://github.com/advisories/GHSA-3xf4-9g3c-4h4w'
tags:
  - ghsa
  - npm
epss: 0.00205
epssPercentile: 0.10478
ingestedAt: '2026-10-30T23:11:25.778Z'
---

## Overview

### Impact

When no `appSecret` is configured (via `NUXT_APP_SECRET`, `NITRO_APP_SECRET` or `runtimeConfig.appSecret`), `nuxt dev` generates a development secret and stores it in `<buildDir>/app-secret` (by default `.nuxt/app-secret`). The build directory is inside the directories that Nuxt passes to Vite's `server.fs.allow`, so the file can be fetched from the dev server:

```bash
curl http://<dev-server>/_nuxt/@fs/<absolute-path-to-project>/.nuxt/app-secret
```

Anyone who can read it can compute every secret derived from it with `deriveSecret()`, including the default password used by `useSession`, and so can forge session cookies accepted by that dev server.

Exploitation requires direct HTTP access to the dev server. `nuxt dev` listens on localhost by default, so this mainly affects dev servers that are exposed to a network (for example with `--host`, a published container port or a tunnel). A malicious website cannot read the file through a developer's browser: Vite's CORS and host checks prevent pages on other origins from reading the response.

Production builds never generate an `appSecret` and are not affected. Dev servers with an explicitly configured `appSecret` do not use the generated file.

### Patches

Fixed in `@nuxt/vite-builder` 4.6.3, which `nuxt` 4.6.3 depends on. The dev server now adds `app-secret` to Vite's `server.fs.deny`, keeping Vite's default deny list.

### Workarounds

Set `NUXT_APP_SECRET` in `.env` to a random value of at least 32 characters (for example the output of `openssl rand -base64 32`), or avoid exposing the dev server to untrusted networks.

If a dev server using a generated secret has been reachable by untrusted clients, delete `.nuxt/app-secret` (a new secret is generated on the next `nuxt dev`) or set `NUXT_APP_SECRET`. Either invalidates existing dev sessions.

## Affected packages

- `@nuxt/vite-builder >= 4.6.0, < 4.6.3`

## Remediation

Upgrade to a patched release:

- `@nuxt/vite-builder 4.6.3`