Sign in
Deutsch English Español Polski
High

Nuxt allows DOS via cache poisoning with payload rendering response

  • Disclosed: 19.03.2025
  • Updated: 11.10.2026 10:22

Summary

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.

Impact

An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable.

Conclusion :

This is similar to a vulnerability in Next.js that resulted in CVE-2024-46982 (and see this article, in particular the "Internal URL parameter and pageProps" part, the latter being very similar to the one concerning us here.)

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package nuxt >= 3.0.0, < 3.16.0 3.16.0

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-349
Platform
npm
Package
nuxt
Disclosed
19.03.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-jvhm-gjrh-3h93 - CC BY 4.0

Vulnerability history: nuxt

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
06.2023 08.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 7
  • Medium 8
  • Low 4

Disclosures per year

Severity:
  1. Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
    High · 7.5 CVE-2026-71321 >= 4.0.0, < 4.5.1, >= 3.1.0, < 3.21.10 4.5.1, 3.21.10
  2. Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
    High · 8.1 CVE-2026-71320 >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10 4.5.1, 3.21.10
  3. Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
    High · 7.5 CVE-2026-71316 >= 4.4.0, < 4.5.1 4.5.1
  4. Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
    High · 8.2 CVE-2026-71315 >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10 4.5.1, 3.21.10
  5. Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
    High · 7.5 CVE-2026-71314 >= 4.0.0, < 4.5.1, >= 3.1.0, < 3.21.10 4.5.1, 3.21.10
  6. Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
    High CVE-2026-53721 >= 4.0.0, < 4.4.7, >= 3.11.0, < 3.21.7 4.4.7, 3.21.7
  7. Nuxt allows DOS via cache poisoning with payload rendering response this entry
    High · 7.5 CVE-2025-27415 >= 3.0.0, < 3.16.0 3.16.0
  8. Nuxt vulnerable to remote code execution via the browser when running the test locally
    Critical · 8.8 CVE-2024-34344 >= 3.4.0, < 3.12.4 3.12.4
  9. nuxt Code Injection vulnerability
    Critical · 8.1 CVE-2023-3224 >= 3.4.0, < 3.4.3 3.4.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.