{"id":"CVE-2025-27415","aliases":["CLSA-2026-1775867594","CLSA-2026-1788450984","CLSA-2026-1792161441","CLSA-2026-1792161460","CLSA-2026-1792161581","CLSA-2026-1792161601","CLSA-2026-1792161804","CLSA-2026-1792161823","CLSA-2026-1792161917","CLSA-2026-1792161936","CLSA-2026-1793661073","EUVD-2025-6776","GHSA-jvhm-gjrh-3h93"],"status":"published","title":"Nuxt allows DOS via cache poisoning with payload rendering response","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00391,"percentile":0.33641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-349"],"published":"2025-03-19T19:02:04Z","modified":"2026-11-03T02:45:02Z","exploits":[{"source":"pocgithub","id":"jiseoung/CVE-2025-27415-PoC","title":"jiseoung/CVE-2025-27415-PoC","date":"2025-07-14","url":"https://github.com/jiseoung/CVE-2025-27415-PoC"}],"fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["3.16.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.16.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.10","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.3-tuxcare.0"},{"fixed":"3.12.3-tuxcare.1"}]}],"versions":["3.12.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.12"}]}],"versions":["3.12.4","3.12.4-tuxcare.11","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5","3.12.4-tuxcare.6","3.12.4-tuxcare.7","3.12.4-tuxcare.8","3.12.4-tuxcare.9"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.6"}]}],"versions":["3.2.0","3.2.0-tuxcare.2","3.2.0-tuxcare.4","3.2.0-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.16.0"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-jvhm-gjrh-3h93","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27415","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jvhm-gjrh-3h93"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27415.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27415","title":"Nuxt allows DOS via cache poisoning with payload rendering response","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.","status":"published","published":"2025-03-19T19:02:04.824Z","modified":"2025-03-19T19:22:25.732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-6776","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.","status":"published","published":"2025-03-19T19:02:04Z","modified":"2025-03-19T19:22:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:58.209763Z"}],"ghsa":[{"id":"GHSA-jvhm-gjrh-3h93","title":"Nuxt allows DOS via cache poisoning with payload rendering response","description":"### Summary\n\nBy sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.\n\nIt is possible to craft a request, such as `https://mysite.com/?/_payload.json` which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.\n\n### Impact\n\nAn attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable.\n\n\n## Conclusion : \n\nThis is similar to a vulnerability in Next.js that resulted in CVE-2024-46982 (and see [this article](https://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixir), in particular the \"Internal URL parameter and pageProps\" part, the latter being very similar to the one concerning us here.)","status":"published","published":"2025-03-19T19:54:25Z","modified":"2025-03-20T19:31:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:38:35.74197Z"}],"nvd":[{"id":"CVE-2025-27415","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.","status":"published","published":"2025-03-19T19:15:47.257Z","modified":"2026-06-17T09:03:32.66Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"CVE-2025-27415","title":"Nuxt allows DOS via cache poisoning with payload rendering response","description":"Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.","status":"published","published":"2025-03-19T19:02:04.824Z","modified":"2026-10-28T02:30:41.075066092Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-jvhm-gjrh-3h93","title":"Nuxt allows DOS via cache poisoning with payload rendering response","description":"### Summary\n\nBy sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.\n\nIt is possible to craft a request, such as `https://mysite.com/?/_payload.json` which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.\n\n### Impact\n\nAn attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable.\n\n\n## Conclusion : \n\nThis is similar to a vulnerability in Next.js that resulted in CVE-2024-46982 (and see [this article](https://zhero-web-sec.github.io/research-and-things/nextjs-cache-and-chains-the-stale-elixir), in particular the \"Internal URL parameter and pageProps\" part, the latter being very similar to the one concerning us here.)","status":"published","published":"2025-03-19T19:54:25Z","modified":"2025-03-20T19:31:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-349"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"CLSA-2026-1775867594","title":"TuxCare security update for nuxt (4 CVEs)","description":"TuxCare rebuilt nuxt to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-10-15T09:46:36.988257257Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1788450984","title":"TuxCare security update for nuxt (11 CVEs)","description":"TuxCare rebuilt nuxt to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-09-03T15:56:24Z","modified":"2026-10-15T09:48:03.152914241Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792161441","title":"TuxCare security update for @nuxt/kit (4 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:37:21Z","modified":"2026-10-16T16:31:02.438072296Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161460","title":"TuxCare security update for @nuxt/kit (11 CVEs)","description":"TuxCare rebuilt @nuxt/kit to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:37:40Z","modified":"2026-10-16T16:31:03.072757342Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161581","title":"TuxCare security update for @nuxt/schema (4 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:39:41Z","modified":"2026-10-16T16:31:11.742633867Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161601","title":"TuxCare security update for @nuxt/schema (11 CVEs)","description":"TuxCare rebuilt @nuxt/schema to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:40:01Z","modified":"2026-10-16T16:31:05.866570588Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161804","title":"TuxCare security update for @nuxt/vite-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:43:24Z","modified":"2026-10-16T16:30:33.702461081Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161823","title":"TuxCare security update for @nuxt/vite-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/vite-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:43:43Z","modified":"2026-10-16T16:30:34.584872899Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161917","title":"TuxCare security update for @nuxt/webpack-builder (4 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 4 CVEs. Fixed in 3.12.3-tuxcare.1.","status":"published","published":"2026-10-16T14:45:17Z","modified":"2026-10-16T16:31:41.011961884Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161936","title":"TuxCare security update for @nuxt/webpack-builder (11 CVEs)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 11 CVEs. Fixed in 3.12.4-tuxcare.12.","status":"published","published":"2026-10-16T14:45:36Z","modified":"2026-10-16T16:31:30.28168697Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1793661073","title":"TuxCare security update for nuxi (2 CVEs)","description":"TuxCare rebuilt nuxi to address 2 CVEs. Fixed in 3.2.0-tuxcare.6.","status":"published","published":"2026-11-03T00:11:14Z","modified":"2026-11-03T02:45:02.355656232Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}