Executive brief
nuxt-api-party is a Nuxt module that proxies API requests without exposing backend credentials. An attacker can send a single crafted HTTP request with an extremely high retry value to cause a stack overflow, crashing the server and making it unavailable to legitimate users. No authentication is required, and the attack can be executed remotely by any network-connected client.
Technical details
The vulnerability is an uncontrolled recursion flaw in nuxt-api-party's handling of ofetch options. The library accepts fetchOptions directly from the request body without filtering which options are allowed, then passes them unvalidated to the ofetch HTTP client. An attacker can construct a POST request to any API endpoint with a deliberately malformed fetch path (e.g., "x:x" or "data:x;base64,...") combined with a very high retry count (e.g., 9999999). Because ofetch's error handling is recursive and the path will never succeed, the server exhausts its stack recursively retrying, causing a stack overflow crash. The vulnerability requires no authentication or user interaction and is exploitable over the network with a single request. A patch is available in version 0.22.0 or later.
Affected products
- Johann Schopplich nuxt-api-party <=0.21.3
Timeline
- 2023-12-08: disclosed
- 2023-12-09: patched: Fixed in version 0.22.0