CVE-2026-102650

{
  "etk_id": "ETK-2026-3744",
  "cve_id": "CVE-2026-102650",
  "display_id": "CVE-2026-102650",
  "ghsa_id": "GHSA-xxrh-5hgg-gj4h",
  "euvd_id": "EUVD-2026-118389",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated database query denial of service in Nuxt Content",
  "summary": "Nuxt Content 3.0.0 through versions before 3.15.2 can process untrusted database query expressions through its unauthenticated content query API. A remote attacker can exhaust CPU or memory and prevent concurrent requests from being served when that server endpoint is exposed. Fully static prerendered deployments that do not publish the endpoint are not affected.",
  "mitigation": "Upgrade the content package to version 3.15.2. Until upgraded, restrict access to the Nuxt Content query endpoint or remove its public exposure.",
  "vendor": "nuxt",
  "product": "content",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.15.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.15.2"
      ],
      "package_name": "@nuxt/content",
      "purl": "pkg:npm/@nuxt/content"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 11.837102766666666,
  "t0_at": "2026-11-06T17:40:05.114000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T18:02:46.997293+00:00",
      "days": 0.015762538113425924,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T17:40:05.114000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-10-21T10:07:24+00:00",
      "days": -16.31436474537037,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T17:40:05.114000+00:00",
      "url": "https://github.com/nuxt/content/security/advisories/GHSA-xxrh-5hgg-gj4h"
    },
    "trigger_signal": {
      "at": "2026-11-06T17:40:05.114000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T17:40:05.114000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102650"
    }
  }
}