CVE-2026-102650

Name of the Vulnerable Software and Affected Versions Nuxt Content versions 3.0.0 through 3.15.1

Description The unauthenticated POST '/ nuxt content/:collection/query' endpoint accepts an attacker-controlled sql field in 'src/runtime/api/query.post.ts' that permits expensive SQLite expressions. While some releases use the assertSafeQuery() function in 'src/runtime/internal/security.ts' to reject certain SQL keywords in WHERE clauses, it still allows function calls such as randomblob(), zeroblob(), hex(), and length(). These queries reach the synchronous better-sqlite3 sink in 'src/runtime/internal/database.server.ts', enabling a single remote request to consume significant CPU and memory, which blocks the Node.js event loop and halts all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected.

Recommendations Update to version 3.15.2.