CVE-2026-102650 · Package
NO FIX YET · SEE WHAT TO DO
Nuxt Content's unauthenticated query endpoint accepts attacker-supplied SQL containing expensive SQLite functions. A single remote request can consume large CPU and memory and block the Node.js event loop, stopping all other requests.
first public Oct 21, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only Nuxt applications using Nuxt Content on a running Node server that exposes the /__nuxt_content/:collection/query endpoint. Fully static prerendered sites that do not expose the server endpoint are not affected. Versions from 3.0.0 through 3.15.2 are affected, and the fix is in 3.15.2.
Not affected if managed-hosting, static-export
Who cares node, nuxt, nuxt-content, self-hosted
@nuxt/content version in package.json or the lockfile; affected versions are 3.0.0 through 3.15.2./__nuxt_content/:collection/query in server or proxy logs.@nuxt/content Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.15.2NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.