{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650) · updates",
  "home_page_url": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650",
  "feed_url": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/feed.json",
  "description": "On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.",
  "language": "en",
  "_pwn": {
    "slug": "nuxt-content-query-api-sqli-dos-cve-2026-102650",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/feed.xml",
    "llms": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/llms.txt",
    "json": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650#2026-10-21-4887091e",
      "url": "https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650#2026-10-21-4887091e",
      "title": "Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650): Nuxt Content publishes GHSA-xxrh-5hgg-gj4h (CVE-2026-102650 unauth SQLite function DoS), GHSA-p7p3-px4q-v2rr (unauth blind SQLi), and GHSA-wjh8-qcrm-wf29 (unauth cross-table reads), fixed starting in 3.15.2.",
      "content_text": "Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650): Nuxt Content publishes GHSA-xxrh-5hgg-gj4h (CVE-2026-102650 unauth SQLite function DoS), GHSA-p7p3-px4q-v2rr (unauth blind SQLi), and GHSA-wjh8-qcrm-wf29 (unauth cross-table reads), fixed starting in 3.15.2.\n\nSource: https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h",
      "date_published": "2026-10-21T00:00:00.000Z",
      "external_url": "https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h",
      "tags": [
        "high"
      ]
    }
  ]
}