Nuxt allows DOS via cache poisoning with payload rendering response

Description

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.16.0
• Patched version(s): 3.16.0

References

• GHSA-jvhm-gjrh-3h93
• CVE-2025-27415
• CWE-349
• CAPEC-310
• OWASP 2021-A6

Related Issues

• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• vite allows server.fs.deny bypass via backslash on Windows - CVE-2025-62522
• Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS - CVE-2026-2581
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075

Tags:

npm

nuxt