Executive brief
Nuxt is a web framework for building JavaScript applications. An attacker can poison a CDN cache by sending crafted requests that cause the framework to render JSON responses in a way that bypasses normal caching rules. Once the cache is poisoned, all visitors to the affected website receive the malicious cached response, causing the site to become unavailable until the cache expires or is manually cleared.
Technical details
This vulnerability is a cache poisoning attack affecting Nuxt applications served behind a CDN. The attack exploits how Nuxt renders payload responses (JSON data) when requests include specific query parameters like /?/_payload.json. When a CDN is configured to ignore query strings during cache key determination, the poisoned response gets cached and served to all subsequent visitors. The root cause is insufficient validation of request parameters before rendering sensitive payload data. An unauthenticated attacker on the network can trigger this via HTTP requests to any publicly accessible Nuxt application. The attacker can cause indefinite denial of service by repeatedly re-poisoning the cache at intervals matching the cache duration. Nuxt 3.16.0 and later include fixes; versions 3.0.0 through 3.15.x are affected.
Affected products
- Nuxt Nuxt 3.0.0 to 3.15.x
Timeline
- 2025-03-19: disclosed: Advisory published
- 2025-03-19: patched: Fixed in version 3.16.0