{"vulnerability": "cve-2026-4999", "sightings": [{"uuid": "84b7c7bf-a5b1-46d0-80a3-029c86971c15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49993", "type": "seen", "source": "https://gist.github.com/alon710/304448ca1233c754404dc0354510a0d3", "content": "# CVE-2026-49993: CVE-2026-49993: Proprietary Source Code Exfiltration via Incomplete Same-Origin Verification in Nuxt Dev Servers\n\n> **CVSS Score:** 5.7\n> **Published:** 2026-06-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49993\n\n## Summary\nCVE-2026-49993 identifies an incomplete same-origin check validation mechanism in @nuxt/webpack-builder and @nuxt/rspack-builder dev server middleware. When the local development server is bound to a non-loopback address, cross-origin attackers can bypass verification checks by suppressing browser headers, leading to unauthorized retrieval and exfiltration of compiled source code chunks.\n\n## TL;DR\nNuxt dev servers bound to non-loopback interfaces allow headerless cross-origin requests, enabling malicious sites to silently exfiltrate proprietary source code from active local development environments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-749\n- **Attack Vector**: Adjacent Network\n- **CVSS v3.1 Score**: 5.7\n- **EPSS Score**: 0.00201\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @nuxt/webpack-builder\n- @nuxt/rspack-builder\n- **@nuxt/webpack-builder**: >= 3.15.4, < 3.21.7 (Fixed in: `3.21.7`)\n- **@nuxt/rspack-builder**: >= 3.15.4, < 3.21.7 (Fixed in: `3.21.7`)\n- **@nuxt/webpack-builder**: >= 4.0.0, < 4.4.7 (Fixed in: `4.4.7`)\n- **@nuxt/rspack-builder**: >= 4.0.0, < 4.4.7 (Fixed in: `4.4.7`)\n\n## Mitigation\n\n- Restrict development server bindings exclusively to loopback addresses (127.0.0.1 or localhost).\n- Utilize modern web browsers that enforce Local Network Access (LNA) protections.\n- Perform local development activities within isolated browser sessions or profiles.\n\n**Remediation Steps:**\n1. Open the package management configuration of the Nuxt project.\n2. Execute the update command: `pnpm update nuxt` or `pnpm update @nuxt/webpack-builder @nuxt/rspack-builder`.\n3. Verify that dependencies resolve to version 3.21.7 (for Nuxt 3) or 4.4.7 (for Nuxt 4) or higher.\n4. Remove configuration variables that bind the development host to 0.0.0.0 or LAN-visible IPs.\n\n## References\n\n- [GitHub Security Advisory GHSA-x6qj-4h56-5rj5](https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5)\n- [GitHub Security Advisory GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g)\n- [Fix Pull Request #35200](https://github.com/nuxt/nuxt/pull/35200)\n- [CVE-2026-49993 Record](https://www.cve.org/CVERecord?id=CVE-2026-49993)\n- [NVD entry for CVE-2026-49993](https://nvd.nist.gov/vuln/detail/CVE-2026-49993)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49993) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-17T00:11:28.000000Z"}, {"uuid": "9fc0e22b-d83a-4cdd-89d4-64d042f0e127", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49993", "type": "seen", "source": "https://gist.github.com/alon710/5a51983a1e4f931f3bc541f627d26823", "content": "# CVE-2026-49993: CVE-2026-49993: Proprietary Source Code Exfiltration via Incomplete Same-Origin Verification in Nuxt Dev Servers\n\n> **CVSS Score:** 5.7\n> **Published:** 2026-06-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49993\n\n## Summary\nCVE-2026-49993 identifies an incomplete same-origin check validation mechanism in @nuxt/webpack-builder and @nuxt/rspack-builder dev server middleware. When the local development server is bound to a non-loopback address, cross-origin attackers can bypass verification checks by suppressing browser headers, leading to unauthorized retrieval and exfiltration of compiled source code chunks.\n\n## TL;DR\nNuxt dev servers bound to non-loopback interfaces allow headerless cross-origin requests, enabling malicious sites to silently exfiltrate proprietary source code from active local development environments.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-749\n- **Attack Vector**: Adjacent Network\n- **CVSS v3.1 Score**: 5.7\n- **EPSS Score**: 0.00201\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- @nuxt/webpack-builder\n- @nuxt/rspack-builder\n- **@nuxt/webpack-builder**: >= 3.15.4, < 3.21.7 (Fixed in: `3.21.7`)\n- **@nuxt/rspack-builder**: >= 3.15.4, < 3.21.7 (Fixed in: `3.21.7`)\n- **@nuxt/webpack-builder**: >= 4.0.0, < 4.4.7 (Fixed in: `4.4.7`)\n- **@nuxt/rspack-builder**: >= 4.0.0, < 4.4.7 (Fixed in: `4.4.7`)\n\n## Mitigation\n\n- Restrict development server bindings exclusively to loopback addresses (127.0.0.1 or localhost).\n- Utilize modern web browsers that enforce Local Network Access (LNA) protections.\n- Perform local development activities within isolated browser sessions or profiles.\n\n**Remediation Steps:**\n1. Open the package management configuration of the Nuxt project.\n2. Execute the update command: `pnpm update nuxt` or `pnpm update @nuxt/webpack-builder @nuxt/rspack-builder`.\n3. Verify that dependencies resolve to version 3.21.7 (for Nuxt 3) or 4.4.7 (for Nuxt 4) or higher.\n4. Remove configuration variables that bind the development host to 0.0.0.0 or LAN-visible IPs.\n\n## References\n\n- [GitHub Security Advisory GHSA-x6qj-4h56-5rj5](https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5)\n- [GitHub Security Advisory GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g)\n- [Fix Pull Request #35200](https://github.com/nuxt/nuxt/pull/35200)\n- [CVE-2026-49993 Record](https://www.cve.org/CVERecord?id=CVE-2026-49993)\n- [NVD entry for CVE-2026-49993](https://nvd.nist.gov/vuln/detail/CVE-2026-49993)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49993) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-17T00:21:33.000000Z"}, {"uuid": "869b6d3d-899e-4303-964c-8fb8f28b770d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49993", "type": "published-proof-of-concept", "source": "https://github.com/nuxt/nuxt/security/advisories/GHSA-x6qj-4h56-5rj5", "content": "", "creation_timestamp": "2026-06-02T14:32:20.000000Z"}, {"uuid": "db09e8cb-f0c9-44ed-992a-3b8802103d63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49991", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfby6r6fp2x", "content": "\ud83d\udfe0 CVE-2026-49991 - High (8.6)\n\nRustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49991/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-29T01:00:35.674103Z"}, {"uuid": "2717f674-02c6-41ba-8d72-737ec4aba238", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49991", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpfpwvwcr226", "content": "CVE-2026-49991 - Critical path traversal in RustFS. Authenticated users can write objects to other tenants' buckets via Snowball auto-extract, breaking isolation. CVSS 8.6. Unpatched. Mitigate immediately. #CVE #infosec #RustFS\n\nhttps://www.valtersit.com/cve/CVE-2026-49991/", "creation_timestamp": "2026-06-29T05:10:23.995116Z"}, {"uuid": "35a33617-b61d-4f2c-904b-551e14e6c8a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49998", "type": "published-proof-of-concept", "source": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-g6vg-wj8f-48cj", "content": "", "creation_timestamp": "2026-07-01T22:35:18.298689Z"}, {"uuid": "6872c681-3e0a-4e0f-915a-d6562b54ebed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49998", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqsf7jmkdr2m", "content": "CVE-2026-49998 - Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass\nCVE ID : CVE-2026-49998\n \n Published : July 16, 2026, 8:16 p.m. | 2\u00a0hours, 17\u00a0minutes ago\n \n Description : Centrifugo is an open-source scalable real-time mess...", "creation_timestamp": "2026-07-16T23:28:09.969294Z"}, {"uuid": "3a37f07b-056c-4ad6-8ac2-763354ec812c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49994", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwlxmixsse2f", "content": "CVE-2026-49994 - bluehood\nIn versions before 0.7.1, Bluehood's web interface required login only for its web pages, not for its API endpoints. This allowed anyone on the same network to view Bluetooth data\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bluehood #dannymcc #CVE #infosec", "creation_timestamp": "2026-09-28T18:40:04.858269Z"}, {"uuid": "c2d442f9-4ce4-4c26-902b-394a04cf1011", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49994", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwm4jukjeg2i", "content": "\ud83d\udea8 CVE-2026-49994 \u2014 CVSS 9.1 CRITICAL\n\nBluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, o...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-49994\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-28T20:08:04.725765Z"}]}