Nuxt allows DOS via cache poisoning with payload rendering response

Description

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON.

Recommendation

Update the nuxt package to the latest compatible version. Followings are version details:

• Affected version(s): >= 3.0.0, < 3.16.0
• Patched version(s): 3.16.0

References

• GHSA-jvhm-gjrh-3h93
• CVE-2025-27415
• CWE-349
• CAPEC-310
• OWASP 2021-A6

Related Issues

• qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - CVE-2025-15284
• FUXA allows Remote Code Execution (RCE) via the project import functionality. - CVE-2025-69983
• webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence - CVE-2025-68157
• Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning - @nuxt/nitro-server - CVE-2026-46342

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

nuxt