Nuxt allows DOS via cache poisoning with payload rendering response

Description

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.16.0
• Patched version(s): 3.16.0

References

• GHSA-jvhm-gjrh-3h93
• CVE-2025-27415
• CWE-349
• CAPEC-310
• OWASP 2021-A6

Related Issues

• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387
• billboard.js allows prototype pollution via the function generate - CVE-2025-49223
• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138

Tags:

npm

nuxt