Nuxt allows DOS via cache poisoning with payload rendering response

Description

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.16.0
• Patched version(s): 3.16.0

References

• GHSA-jvhm-gjrh-3h93
• CVE-2025-27415
• CWE-349
• CAPEC-310
• OWASP 2021-A6

Related Issues

• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning - CVE-2026-46342
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• vite allows server.fs.deny bypass via backslash on Windows - CVE-2025-62522

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nuxt