High, CVSS 7.5npmAmendedPublished
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
CVE-2026-102650 · GHSA-xxrh-5hgg-gj4h
- Affected
- npm @nuxt/content >= 3.0.0, < 3.15.2
- Fixed in
- 3.15.2· Vendor fix available
- Issue
- The `POST /__nuxt_content/:collection/query` endpoint in `@nuxt/content` accepts an attacker-controlled `sql` field from the HTTP request body and executes it against a local SQLite database after passing it through an insufficient validator (`assertSafeQuery`). The validator only blocks a small set of SQL command keywords and does not reject expensive SQLite built-in functions such as `randomblob()`, `zeroblob()`, `hex()`, or `length()`. An unauthenticated remote attacker can craft a single request that forces SQLite to allocate hundreds of megabytes of memory and perform CPU-intensive work, causing server-wide denial of service. This endpoint is enabled by default for every collection and requires no authentication. Details The vulnerability spans three source files: Route registration — `src/module.ts:207-208` The Nuxt Content module registers a public HTTP POST handler for each configured collection at startup: ```ts // src/module.ts:207-208 addServerHandler({…
Recommended action: Upgrade to 3.15.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.