{"id":"CVE-2026-102650","kind":"vulnerability","aliases":["CVE-2026-102650"],"related":[],"title":"Nuxt Content: unauthenticated SQL query endpoint lets one request freeze the server","description":"Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2.","summary":"Nuxt Content's unauthenticated query endpoint accepts attacker-supplied SQL containing expensive SQLite functions. A single remote request can consume large CPU and memory and block the Node.js event loop, stopping all other requests.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","nuxt","nuxt-content","package","self-hosted"],"not_affected_if":["managed-hosting","static-export"],"how_to_check":"- Check the installed `@nuxt/content` version in `package.json` or the lockfile; affected versions are `3.0.0` through `3.15.2`.\n- Check whether the app is fully static prerendered; those deployments do not expose the server endpoint and are not affected.\n- Look for requests to `/__nuxt_content/:collection/query` in server or proxy logs.","fix":"- `@nuxt/content` `3.15.2`","status":"open","published_at":"2026-11-06T18:17:37+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","triaged_at":"2026-11-06T18:45:17+00:00","updated_at":"2026-11-06T18:45:17+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T18:45:17Z","model":"claude-haiku-5-5","output":{"fix":"- `@nuxt/content` `3.15.2`","reach":"internet","title":"Nuxt Content: unauthenticated SQL query endpoint lets one request freeze the server","impact":"medium","summary":"Nuxt Content's unauthenticated query endpoint accepts attacker-supplied SQL containing expensive SQLite functions. A single remote request can consume large CPU and memory and block the Node.js event loop, stopping all other requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["nuxt","nuxt-content","node","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"one request blocks the server's event loop and exhausts CPU and memory","analyst_note":"","how_to_check":"- Check the installed `@nuxt/content` version in `package.json` or the lockfile; affected versions are `3.0.0` through `3.15.2`.\n- Check whether the app is fully static prerendered; those deployments do not expose the server endpoint and are not affected.\n- Look for requests to `/__nuxt_content/:collection/query` in server or proxy logs.","plain_action":"","needs_analyst":false,"not_affected_if":["static-export","managed-hosting"],"who_is_affected":"Only Nuxt applications using Nuxt Content on a running Node server that exposes the `/__nuxt_content/:collection/query` endpoint. Fully static prerendered sites that do not expose the server endpoint are not affected. Versions from 3.0.0 through 3.15.2 are affected, and the fix is in 3.15.2.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4512,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102650':15A,18A '-2026':14A,17A '/__nuxt_content':87C '3.0.0':81C,105C '3.15.2':83C,195C 'accept':34B,90C 'affect':111C,188C 'allow':153C 'applic':73C 'assertsafequeri':114C 'attack':36B,93C 'attacker-control':92C 'attacker-suppli':35B 'base':69C 'better':148C 'better-sqlite3':147C 'block':54B,165C 'call':135C 'claus':131C 'cms':70C 'collection/query':88C 'command':127C 'compon':79C 'concurr':172C 'consum':48B,159C 'contain':39B 'content':2A,23B,29B,64C 'control':94C 'cpu':50B,161C 'cve':13A,16A 'deploy':178C 'endpoint':6A,33B,89C,185C 'event':57B,168C 'expens':40B,101C 'expos':182C 'express':103C 'field':96C 'file':68C 'file-bas':67C 'fix':192C 'freez':10A 'fulli':175C 'function':42B,134C 'gap':120C 'handl':174C 'hex':139C 'host':27B 'includ':136C 'issu':190C 'keyword':128C 'larg':49B 'length':141C 'let':7A 'list':124C 'loop':58B,169C 'markdown':76C 'memori':52B,163C 'node':19B 'node.js':56B,167C 'nuxt':1A,20B,22B,28B,63C,72C 'nuxt-cont':21B 'one':8A 'packag':24B 'perform':106C 'permit':100C,133C 'post':86C 'power':74C 'prerend':177C 'queri':5A,32B,108C,143C 'randomblob':137C 'reach':144C 'reject':121C 'releas':112C 'remot':45B,156C 'report':118C 'request':9A,46B,62B,157C,173C 'self':26B 'self-host':25B 'server':12A,184C 'short':123C 'singl':44B,155C 'sink':150C 'sql':4A,38B,95C,126C 'sqlite':41B,102C 'sqlite3':149C 'src/runtime/api/query.post.ts':98C 'src/runtime/internal/database.server.ts':152C 'src/runtime/internal/security.ts':116C 'static':176C 'stop':59B 'substanti':160C 'suppli':37B 'synchron':146C 'unauthent':3A,31B,85C 'use':113C 'valid':109C,119C 'version':104C,194C 'vue':78C 'zeroblob':138C","nicknames":[],"mitigations":[],"who_affected":"Only Nuxt applications using Nuxt Content on a running Node server that exposes the `/__nuxt_content/:collection/query` endpoint. Fully static prerendered sites that do not expose the server endpoint are not affected. Versions from 3.0.0 through 3.15.2 are affected, and the fix is in 3.15.2.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","node","nuxt","nuxtcontent","package","selfhosted"],"campaign_type":null,"search_a":"'-102650':15A,18A '-2026':14A,17A 'content':2A 'cve':13A,16A 'endpoint':6A 'freez':10A 'let':7A 'nuxt':1A 'one':8A 'queri':5A 'request':9A 'server':12A 'sql':4A 'unauthent':3A","search_b":"'accept':34B 'attack':36B 'attacker-suppli':35B 'block':54B 'consum':48B 'contain':39B 'content':23B,29B 'cpu':50B 'endpoint':33B 'event':57B 'expens':40B 'function':42B 'host':27B 'larg':49B 'loop':58B 'memori':52B 'node':19B 'node.js':56B 'nuxt':20B,22B,28B 'nuxt-cont':21B 'packag':24B 'queri':32B 'remot':45B 'request':46B,62B 'self':26B 'self-host':25B 'singl':44B 'sql':38B 'sqlite':41B 'stop':59B 'suppli':37B 'unauthent':31B","search_c":"'/__nuxt_content':87C '3.0.0':81C,105C '3.15.2':83C,195C 'accept':90C 'affect':111C,188C 'allow':153C 'applic':73C 'assertsafequeri':114C 'attack':93C 'attacker-control':92C 'base':69C 'better':148C 'better-sqlite3':147C 'block':165C 'call':135C 'claus':131C 'cms':70C 'collection/query':88C 'command':127C 'compon':79C 'concurr':172C 'consum':159C 'content':64C 'control':94C 'cpu':161C 'deploy':178C 'endpoint':89C,185C 'event':168C 'expens':101C 'expos':182C 'express':103C 'field':96C 'file':68C 'file-bas':67C 'fix':192C 'fulli':175C 'function':134C 'gap':120C 'handl':174C 'hex':139C 'includ':136C 'issu':190C 'keyword':128C 'length':141C 'list':124C 'loop':169C 'markdown':76C 'memori':163C 'node.js':167C 'nuxt':63C,72C 'perform':106C 'permit':100C,133C 'post':86C 'power':74C 'prerend':177C 'queri':108C,143C 'randomblob':137C 'reach':144C 'reject':121C 'releas':112C 'remot':156C 'report':118C 'request':157C,173C 'server':184C 'short':123C 'singl':155C 'sink':150C 'sql':95C,126C 'sqlite':102C 'sqlite3':149C 'src/runtime/api/query.post.ts':98C 'src/runtime/internal/database.server.ts':152C 'src/runtime/internal/security.ts':116C 'static':176C 'substanti':160C 'synchron':146C 'unauthent':85C 'use':113C 'valid':109C,119C 'version':104C,194C 'vue':78C 'zeroblob':138C","first_public_at":"2026-10-21T10:07:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102650","severity":null,"published_at":"2026-11-06T18:17:37+00:00","modified_at":"2026-11-06T18:17:37+00:00","first_seen_at":"2026-11-06T18:44:08+00:00","fetched_at":"2026-11-06T18:44:08+00:00","note":null}],"documents":[{"id":88831,"url":"https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88832,"url":"https://github.com/nuxt/content/releases/tag/v3.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":88833,"url":"https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T10:07:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}