Is nuxt affected by GHSA-534h-c3cw-v3h9?

npm nuxt is affected in >=4.0.0 =3.18.0 <3.21.7.

Is GHSA-534h-c3cw-v3h9 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

medium

GHSA-534h-c3cw-v3h9

Q: Is GHSA-534h-c3cw-v3h9 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

npm · nuxt

Summary

Nuxt dev server vite-node IPC socket is world-connectable on Linux

Severity: medium
Published: 2026-06-16

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9
https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5
https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea

Related advisories

CVE-2026-71321 — high · npm/nuxt
CVE-2026-71320 — high · npm/nuxt
CVE-2026-71316 — high · npm/nuxt
CVE-2026-71315 — high · npm/nuxt
CVE-2026-71314 — high · npm/nuxt
CVE-2026-53721 — high · npm/nuxt
GHSA-4jjw-pwvw-q6w3 — medium · npm/nuxt
CVE-2026-72744 — medium · npm/nuxt

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.