Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650)

On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.

Why this severity: Three High GHSA advisories on the default unauthenticated content query endpoint; CVE-2026-102650 unauth DoS (CVSS 7.5) plus unauth blind SQLi and cross-table reads

Started

Oct 21, 2026

CVE

CVE-2026-102650

• npm
• #Nuxt
• #Sqlite
• SQL injection
• #DoS

Notes & caveats

Cite Nuxt/GitHub advisories only. Do not cite cve.now. GHSA-p7p3-px4q-v2rr and GHSA-wjh8-qcrm-wf29 had no CVE ID assigned on the GitHub advisory API at add time.