CVE-2025-27415: Nuxt allows DOS via cache poisoning with payload rendering response

Published Mar 19, 2025
·
Updated

Summary

By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.

It is possible to craft a request, such as https://mysite.com/?/payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.

Impact

An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable.

Conclusion :

This is similar to a vulnerability in Next.js that resulted in CVE-2024-46982 (and see this article, in particular the "Internal URL parameter and pageProps" part, the latter being very similar to the one concerning us here.)

Other sources

Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.

MITRE

Affected Software

3 affected componentsFixes available
Nuxt Nuxt<3.16.0
npm/nuxt>=3.0.0<3.16.0
3.16.0
Nuxt Nuxt>=3.0.0<3.16.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/nuxt to a version that resolves this vulnerability.

    Fixed in 3.16.0
  2. Upgrade

    Upgrade Nuxt to a version that resolves this vulnerability.

    Fixed in 3.16.0

Event History

Mar 19, 2025
CVE Published
via MITRE·07:02 PM
Data Sourced
via MITRE·07:02 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
Affected Software
Advisory Published
via GitHub·07:54 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-27415?

CVE-2025-27415 has a high severity level due to its potential to poison the CDN cache and affect site availability.

2

How do I fix CVE-2025-27415?

To fix CVE-2025-27415, upgrade your Nuxt framework to version 3.16.0 or later.

3

What versions of Nuxt are affected by CVE-2025-27415?

CVE-2025-27415 affects all versions of Nuxt prior to 3.16.0.

4

What types of attacks are possible with CVE-2025-27415?

CVE-2025-27415 allows for crafted HTTP requests that can poison the CDN cache, impacting site availability.

5

Is CVE-2025-27415 related to CDN cache issues?

Yes, CVE-2025-27415 specifically involves vulnerabilities that can lead to CDN cache poisoning.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203