---
id: "CVE-2026-102650"
page: "https://infrastack.ai/live/CVE-2026-102650"
kind: "vulnerability"
aliases: ["CVE-2026-102650"]
title: "Nuxt Content: unauthenticated SQL query endpoint lets one request freeze the server"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node", "nuxt", "nuxt-content", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "static-export"]
published_at: "2026-11-06T18:17:37+00:00"
first_seen_at: "2026-11-06T18:44:08+00:00"
updated_at: "2026-11-06T18:45:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102650", "first_seen_at": "2026-11-06T18:44:08+00:00"}]
exploit_sources: []
---

# Nuxt Content: unauthenticated SQL query endpoint lets one request freeze the server

Link for people: https://infrastack.ai/live/CVE-2026-102650 (this .md is for agents)

Nuxt Content's unauthenticated query endpoint accepts attacker-supplied SQL containing expensive SQLite functions. A single remote request can consume large CPU and memory and block the Node.js event loop, stopping all other requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `@nuxt/content` version in `package.json` or the lockfile; affected versions are `3.0.0` through `3.15.2`.
- Check whether the app is fully static prerendered; those deployments do not expose the server endpoint and are not affected.
- Look for requests to `/__nuxt_content/:collection/query` in server or proxy logs.

## Fix

- `@nuxt/content` `3.15.2`

## Timeline

- 2026-11-06T18:44:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102650

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h
- [fix] Patch: github.com https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed
- [fix] Release notes: github.com https://github.com/nuxt/content/releases/tag/v3.15.2

## From the sources

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_