CVE-2026-71319: Critical Nuxt DevTools WebSocket RCE (CVSS 9.6)

Executive Summary

A critical remote code execution vulnerability (CVE-2026-71319) has been disclosed in Nuxt DevTools, the built-in development tooling for the Nuxt Vue.js framework. The flaw carries a CVSS score of 9.6 and allows any attacker on the same local network — or any attacker who can trick a developer into visiting a malicious website — to execute arbitrary code on the developer's machine without authentication.

CVSS Score: 9.6 (Critical)

The vulnerability exists because Nuxt DevTools exposes a bidirectional RPC (Remote Procedure Call) channel over the same Vite HMR (Hot Module Replacement) WebSocket that powers live-reload in development. The DevTools server accepts RPC invocations without verifying the caller's identity or origin, allowing any reachable host to invoke sensitive internal methods. The flaw is patched in Nuxt 3.3.1.

Vulnerability Overview

Affected Versions

Note: This vulnerability is development-mode only. Production builds do not include DevTools or the vulnerable HMR WebSocket endpoint.

Technical Details

How the Attack Works

Nuxt DevTools communicates between the browser IDE panel and the Nuxt dev server using a bidirectional RPC mechanism layered on top of the Vite WebSocket (/__vite_hmr). This channel supports dozens of internal methods including file system access, process execution helpers, and plugin management.

The RPC channel lacked:

• Origin validation — any WebSocket client could connect and invoke methods
• Authentication — no tokens or session binding were required
• Method allowlisting — internal methods were directly callable

Attack Flow:
1. Attacker identifies a Nuxt dev server on the LAN (default :3000)
2. Attacker connects to ws://target:3000/__nuxt_devtools_rpc
3. Attacker sends a crafted RPC invocation payload to an internal method
4. Nuxt DevTools executes the requested operation with the dev server's privileges
5. Arbitrary code execution on the developer's machine

Browser-Based Attack Path

Even if the dev server is not directly reachable, an attacker can exploit this via a cross-site WebSocket hijacking attack:

1. Developer visits a malicious website while their Nuxt dev server is running on localhost
2. Malicious JavaScript connects to ws://localhost:3000/__nuxt_devtools_rpc from the browser
3. Same-origin policy does not block WebSocket connections — the browser relays the attack
4. Arbitrary RPC methods are invoked against the local dev server

Impact

Immediate Remediation

Step 1: Update Nuxt

# npm
npm install nuxt@latest
 
# pnpm
pnpm add nuxt@latest
 
# yarn
yarn add nuxt@latest
 
# Verify version
npx nuxi --version

Confirm you are running 3.3.1 or later.

Step 2: Interim Workaround (If Immediate Update Is Not Possible)

Disable DevTools in your Nuxt configuration:

// nuxt.config.ts
export default defineNuxtConfig({
  devtools: { enabled: false }
})

Step 3: Network-Level Controls

While DevTools should be disabled as the primary fix, defense in depth includes:

# Bind the dev server to localhost only (not all interfaces)
# In package.json or nuxt.config.ts:
export default defineNuxtConfig({
  devServer: {
    host: '127.0.0.1'
  }
})

This prevents LAN-based attacks but does not mitigate browser-based cross-origin WebSocket attacks.

Detection

Monitor WebSocket traffic on development machines, especially connections originating from external IP addresses or unexpected browser origins.

Remediation Checklist

• Update Nuxt to 3.3.1 or later (npm install nuxt@latest)
• If update is delayed, set devtools: { enabled: false } in nuxt.config.ts
• Bind the dev server to 127.0.0.1 to reduce LAN exposure
• Rotate any secrets in .env files that were accessible during the vulnerability window
• Review git history for unexpected file modifications during the exposure window
• Enforce network segmentation so dev machines are not reachable from guest networks

References

• NVD — CVE-2026-71319
• Nuxt Security Advisory
• Nuxt 3.3.1 Release Notes

Related Advisories

• CVE-2026-3055: Citrix NetScaler Memory Overread
• Critical Nuxt.js Vulnerability in Active Exploitation