The unauthenticated POST '/ nuxt content/:collection/query' endpoint accepts an attacker-controlled `sql` field in 'src/runtime/api/query.post.ts' that permits expensive SQLite expressions. While some releases use the `assertSafeQuery()` function in 'src/runtime/internal/security.ts' to reject certain SQL keywords in WHERE clauses, it still allows function calls such as `randomblob()`, `zeroblob()`, `hex()`, and `length()`. These queries reach the synchronous better-sqlite3 sink in 'src/runtime/internal/database.server.ts', enabling a single remote request to consume significant CPU and memory, which blocks the Node.js event loop and halts all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected.