CVE-2026-102650— Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

Quick assessment

Affected

nuxt content

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt Content 是专为 Nuxt 应用设计的基于文件的 CMS，由 Markdown 和 Vue 组件驱动。在 3.0.0 至 3.15.2 版本中，未经验证的接口在中接受攻击者可控的字段，并允许执行高成本的 SQLite 表达式。3.0.0 版本未进行任何查询验证；而在受影响版本中，里使用的函数仅拒绝 WHERE 子句中的一小部分 SQL 命令关键字，却仍允许调用、、和等函数。该查询最终会到达中的同步接口，使得单个远程请求即可消耗大量 CPU 和内存资源，同时阻塞 Node.js

CVSS 7.5 · High Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

Vendor	Product	Version Range	Status
nuxt	content	`>= 3.0.0, < 3.15.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

Source: CVE Program / CVE List V5

Vulnerability Description

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nuxt	content	>= 3.0.0, < 3.15.2	-

II. Public POCs for CVE-2026-102650

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102650

请登录查看更多情报信息。

Other References for CVE-2026-102650 (4)

https://github.com/nuxt/content/pull/3819 x_refsource_MISC
https://github.com/nuxt/content/releases/tag/v3.15.2 x_refsource_MISC
https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h x_refsource_CONFIRM
https://github.com/nuxt/content/commit/847d523a48e76d861175b325abf0de40dc5864ed x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-102650

IV. Related Vulnerabilities

Same product: content

Same vendor: nuxt

Same weakness: CWE-400