CVE-2025-27415 Details
Description
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
A denial-of-service vulnerability has been identified in Nuxt versions greater than 3.0.0 and prior to 3.16.0. This issue arises when a crafted HTTP request is sent to a server behind a CDN, potentially poisoning the CDN cache and severely impacting the site's availability. The vulnerability occurs if the CDN ignores the query string while caching routes, allowing a JSON response from a specific payload request to be served to future visitors. This cache poisoning can lead to the site becoming indefinitely unavailable. Additionally, if the cache is reset, a script can be used to repeatedly send requests at intervals corresponding to the caching duration, permanently poisoning the cache and causing complete unavailability of the site.
Users can upgrade to Nuxt version 3.16.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/security/advisories/GHSA-jvhm-gjrh-3h93 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt | >= 3.0.0, < 3.16.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 3, 2025 | Initial Analysis | [email protected] |
| Mar 19, 2025 | New CVE Received | [email protected] |