@nuxt/webpack-builder and @nuxt/rspack-builder: incomplete fix for source code theft via dev server
Incomplete fix for GHSA-6m52-m754-pw2g in @nuxt/webpack-builder and @nuxt/rspack-builder: source code may still be stolen during dev when using webpack/rspack builder if dev server is bound to a non-loopback address and developer opens a malicious site on the same network.
What changed
Incomplete fix for GHSA-6m52-m754-pw2g in @nuxt/webpack-builder and @nuxt/rspack-builder: source code may still be stolen during dev when using webpack/rspack builder if dev server is bound to a non-loopback address and developer opens a malicious site on the same network. Fixed in versions 4.4.7 and 3.21.7.
Who it affects
Users using @nuxt/webpack-builder or @nuxt/rspack-builder with `nuxt dev --host` (or `--host 0.0.0.0`). Chrome 142+ users are protected by Local Network Access restrictions. Vite builder is not affected.
What to do today
Upgrade @nuxt/webpack-builder to 4.4.7 or 3.21.7 (or @nuxt/rspack-builder accordingly). If unable to upgrade, avoid using `nuxt dev --host`, use Chrome 142+, or switch to Vite builder.