Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650) ยท updates https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650 On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed. en Wed, 21 Oct 2026 00:00:00 GMT Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650): Nuxt Content publishes GHSA-xxrh-5hgg-gj4h (CVE-2026-102650 unauth SQLite function DoS), GHSA-p7p3-px4q-v2rr (unauth blind SQLi), and GHSA-wjh8-qcrm-wf29 (unauth cross-table reads), fixed starting in 3.15.2. https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650 https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650#2026-10-21-4887091e Wed, 21 Oct 2026 00:00:00 GMT high <p><a href="https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h">Source</a></p>