# Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650) · pwn.watch

> On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.

Page: https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650 · generated 2026-11-06T20:02:14.830Z

## Status
- Severity: high · status: live · patch: patched
- Product: nuxt/content (Nuxt Content query API)
- Started: 2026-10-21
- CVEs: CVE-2026-102650
- Affected: nuxt/content >= 3.0.0, < 3.15.2
- Fixed in: 3.15.2; 3.16.2 (recommended; further assertSafeQuery hardening)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/feed.xml
- JSON Feed: https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650.json
- This file: https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650/llms.txt

## Updates (newest first)
- 2026-10-21: Nuxt Content publishes GHSA-xxrh-5hgg-gj4h (CVE-2026-102650 unauth SQLite function DoS), GHSA-p7p3-px4q-v2rr (unauth blind SQLi), and GHSA-wjh8-qcrm-wf29 (unauth cross-table reads), fixed starting in 3.15.2. (https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h)

## Fix brief
# Security brief: Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650)

Source: https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650 · status: live · severity: high · updated Nov 6, 2026, 19:15 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.

Severity detail: Three High GHSA advisories on the default unauthenticated content query endpoint; CVE-2026-102650 unauth DoS (CVSS 7.5) plus unauth blind SQLi and cross-table reads

- Product: nuxt/content (Nuxt Content query API)
- CVE / advisory ids: CVE-2026-102650

## Affected versions
- nuxt/content >= 3.0.0, < 3.15.2

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 3.15.2
- 3.16.2 (recommended; further assertSafeQuery hardening)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Upgrade nuxt/content to >=3.16.2. If you cannot upgrade, block or restrict POST /__nuxt_content/*/query at the reverse proxy/WAF, or fully prerender so the query endpoint is not deployed. Static prerendered sites without the API route are not affected.

## Latest updates
- Oct 21, 2026: Nuxt Content publishes GHSA-xxrh-5hgg-gj4h (CVE-2026-102650 unauth SQLite function DoS), GHSA-p7p3-px4q-v2rr (unauth blind SQLi), and GHSA-wjh8-qcrm-wf29 (unauth cross-table reads), fixed starting in 3.15.2.

## Advisories
- [Unauthenticated denial of service via SQLite functions in /__nuxt_content/:collection/query (GHSA-xxrh-5hgg-gj4h / CVE-2026-102650)](https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h) (Nuxt Content / GitHub)
- [Unauthenticated blind SQL injection via assertSafeQuery bypass (GHSA-p7p3-px4q-v2rr)](https://github.com/nuxt/content/security/advisories/GHSA-p7p3-px4q-v2rr) (Nuxt Content / GitHub)
- [Improper SQL query validation allows unauthenticated cross-table data reads (GHSA-wjh8-qcrm-wf29)](https://github.com/nuxt/content/security/advisories/GHSA-wjh8-qcrm-wf29) (Nuxt Content / GitHub)

## Caveats
Cite Nuxt/GitHub advisories only. Do not cite cve.now. GHSA-p7p3-px4q-v2rr and GHSA-wjh8-qcrm-wf29 had no CVE ID assigned on the GitHub advisory API at add time.

---
Machine-readable: https://pwn.watch/i/nuxt-content-query-api-sqli-dos-cve-2026-102650.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.