Nuxt Content: Unauthenticated SQLite Function Denial of Service

The POST /__nuxt_content/:collection/query endpoint in @nuxt/content contains a validation gap that permits an attacker to execute resource-intensive SQLite built-in functions, such as randomblob(), zeroblob(), hex(), and length(). Because better-sqlite3 processes queries synchronously, these operations block the Node.js event loop, resulting in a server-wide denial of service.

Attack Chain

1. An unauthenticated attacker sends a crafted POST request to /__nuxt_content/:collection/query.
2. The input is processed by assertSafeQuery, which only filters specific SQL keywords and fails to block resource-intensive function calls.
3. The malicious SQL is executed synchronously via better-sqlite3.
4. The application event loop is blocked, causing service disruption.

Impact

Successful exploitation results in high-availability impact, as unauthenticated remote attackers can exhaust server CPU and memory resources to force total service disruption.

Recommendation

Restrict access to the /__nuxt_content/*/query endpoint or ensure the application is correctly updated if an official patch is available. Fully static deployments that do not use the API route are not affected.