{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/npm/@nuxt/content/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["npm/@nuxt/content"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","web-vulnerability","npm","nuxt"],"_cs_type":"advisory","_cs_vendors":["Nuxt"],"content_html":"\u003cp\u003eThe \u003ccode\u003ePOST /__nuxt_content/:collection/query\u003c/code\u003e endpoint in \u003ccode\u003e@nuxt/content\u003c/code\u003e contains a validation gap that permits an attacker to execute resource-intensive SQLite built-in functions, such as \u003ccode\u003erandomblob()\u003c/code\u003e, \u003ccode\u003ezeroblob()\u003c/code\u003e, \u003ccode\u003ehex()\u003c/code\u003e, and \u003ccode\u003elength()\u003c/code\u003e. Because \u003ccode\u003ebetter-sqlite3\u003c/code\u003e processes queries synchronously, these operations block the Node.js event loop, resulting in a server-wide denial of service.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends a crafted POST request to \u003ccode\u003e/__nuxt_content/:collection/query\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe input is processed by \u003ccode\u003eassertSafeQuery\u003c/code\u003e, which only filters specific SQL keywords and fails to block resource-intensive function calls.\u003c/li\u003e\n\u003cli\u003eThe malicious SQL is executed synchronously via \u003ccode\u003ebetter-sqlite3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application event loop is blocked, causing service disruption.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in high-availability impact, as unauthenticated remote attackers can exhaust server CPU and memory resources to force total service disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eRestrict access to the \u003ccode\u003e/__nuxt_content/*/query\u003c/code\u003e endpoint or ensure the application is correctly updated if an official patch is available. Fully static deployments that do not use the API route are not affected.\u003c/p\u003e\n","date_modified":"2026-11-11T16:06:04Z","date_published":"2026-11-11T16:06:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-nuxt-content-dos-ghsa-xxrh-5hgg-gj4h/","summary":"An unauthenticated remote denial-of-service vulnerability in @nuxt/content allows attackers to trigger resource-intensive SQLite functions, blocking the Node.js event loop.","title":"Nuxt Content: Unauthenticated SQLite Function Denial of Service","url":"https://feed.craftedsignal.io/briefs/2026-11-nuxt-content-dos-ghsa-xxrh-5hgg-gj4h/"}],"language":"en","title":"CraftedSignal Threat Feed - Npm/@Nuxt/Content","version":"https://jsonfeed.org/version/1.1"}