CVE-2025-27415 Nuxt allows DOS via cache poisoning with payload rendering response
Attackers can poison CDN caches via crafted requests, causing permanent denial of service for sites using Nuxt behind misconfigured CDNs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27415?
CVE-2025-27415 is a high-severity denial of service vulnerability in nuxt, published on 19 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.
Weakness: CWE-349
Which versions are affected by CVE-2025-27415?
2 open source packages ship an affected version, including nuxt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nuxt npm | From 3.0.0 | 3.16.0 |
nuxt npm | From 3.0.0 | 3.16.0 |
Products include Nuxt Nuxt.
How do I fix CVE-2025-27415?
Upgrade nuxt to 3.16.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-27415 being exploited?
There is no known exploitation of CVE-2025-27415 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in nuxt
- CVE-2026-53721 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
- CVE-2024-23657 Path Traversal: '../filedir' in Nuxt Devtools
- CVE-2024-34344 Remote code execution via the browser when running the test locally in nuxt
- CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
- CVE-2023-3224 Code Injection in nuxt/nuxt
Sources
Also known as GHSA-jvhm-gjrh-3h93.