Nuxt
Security incidents tagged Nuxt. Newest first.
1 Nuxt incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 16
- Longest quiet run: 16 days (Oct 22–Nov 6)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Nuxt Content: unauthenticated SQLite query API DoS and SQLi via /__nuxt_content/:collection/query (CVE-2026-102650)
On Oct 21 2026 the Nuxt Content maintainers published three High advisories for the default unauthenticated POST /__nuxt_content/:collection/query endpoint in nuxt/content v3. CVE-2026-102650 (GHSA-xxrh-5hgg-gj4h): assertSafeQuery blocked only a small set of SQL keywords and did not reject expensive SQLite functions (randomblob/zeroblob/hex/length), so an unauthenticated attacker could force large allocations and block the Node event loop (DoS). GHSA-p7p3-px4q-v2rr: quote-escape and FROM-matching bugs in assertSafeQuery enabled unauthenticated boolean-blind SQL injection to read any table the DB user can see. GHSA-wjh8-qcrm-wf29: improper validation allowed unauthenticated cross-table data reads. Affected: nuxt/content >=3.0.0 <3.15.2 (fixed DoS/SQLi class in 3.15.2); further hardening in 3.16.1/3.16.2. Upgrade to >=3.16.2. Fully static prerendered deployments without the API route are not affected. Workaround: block POST /__nuxt_content/*/query at the proxy/WAF or prerender so the endpoint is not deployed.
nuxt/content (Nuxt Content query API)Since Oct 21, 2026
