Nuxt Content unauthenticated SQLite function denial of service in query API
A Nuxt website content tool can be stalled by a single request.
Summary
An unauthenticated attacker can send expensive SQLite functions to the Nuxt Content query API, and one request can stall the server. Versions from 3.0.0 until 3.15.2 are affected.
Affected when
- Deployment exposes the server endpoint (not fully static prerendered)
- Version 3.0.0 or later, before 3.15.2
What to do
Update to version 3.15.2 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen