Npm/@Nuxt/Content - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/npm/@nuxt/content/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:06:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNuxt Content: Unauthenticated SQLite Function Denial of Servicehttps://feed.craftedsignal.io/briefs/2026-11-nuxt-content-dos-ghsa-xxrh-5hgg-gj4h/Wed, 11 Nov 2026 16:06:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-nuxt-content-dos-ghsa-xxrh-5hgg-gj4h/An unauthenticated remote denial-of-service vulnerability in @nuxt/content allows attackers to trigger resource-intensive SQLite functions, blocking the Node.js event loop.The POST /__nuxt_content/:collection/query endpoint in @nuxt/content contains a validation gap that permits an attacker to execute resource-intensive SQLite built-in functions, such as randomblob(), zeroblob(), hex(), and length(). Because better-sqlite3 processes queries synchronously, these operations block the Node.js event loop, resulting in a server-wide denial of service.

Attack Chain

  1. An unauthenticated attacker sends a crafted POST request to /__nuxt_content/:collection/query.
  2. The input is processed by assertSafeQuery, which only filters specific SQL keywords and fails to block resource-intensive function calls.
  3. The malicious SQL is executed synchronously via better-sqlite3.
  4. The application event loop is blocked, causing service disruption.

Impact

Successful exploitation results in high-availability impact, as unauthenticated remote attackers can exhaust server CPU and memory resources to force total service disruption.

Recommendation

Restrict access to the /__nuxt_content/*/query endpoint or ensure the application is correctly updated if an official patch is available. Fully static deployments that do not use the API route are not affected.

]]>mediumadvisorydenial-of-serviceweb-vulnerabilitynpmnuxt