Information Exposure Affecting @nuxt/nitro-server package, versions >=3.21.7 <3.21.10>=4.4.7 <4.5.1

@nuxt/nitro-server is a Nitro server integration for Nuxt

Affected versions of this package are vulnerable to Information Exposure through the Chrome DevTools workspace endpoint in packages/nitro-server/src/index.ts. An attacker can retrieve the project’s absolute filesystem root and persistent workspace UUID by sending a direct request to /.well-known/appspecific/com.chrome.devtools.json on a network-reachable dev server and spoofing local-looking request headers such as Host: localhost. The endpoint’s isLocalDevRequest gate trusts request metadata instead of the connected TCP peer address, so a LAN client that can reach the dev server can bypass the intended local-only check without browser-origin headers. This leaks sensitive project path information to anyone with network access to the development port, potentially exposing workspace layout and identifiers used by Chrome DevTools auto-mapping.

Workarounds

• Do not bind the Nuxt dev server to a non-loopback interface on an untrusted network; keep it reachable only from localhost, or restrict access to the dev port with a firewall. This prevents LAN clients from reaching /.well-known/appspecific/com.chrome.devtools.json and leaking the project root and workspace UUID.
• Disable experimental.chromeDevtoolsProjectSettings in nuxt.config. This prevents the Chrome DevTools workspace endpoint from being enabled on the dev server.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory