PT-2025-11961 · Nuxt · Nuxt

Published 2025-03-19 · Updated 2025-12-03 · CVE-2025-27415

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 3.16.0

Description Nuxt is an open-source web development framework for Vue.js. By sending a crafted HTTP request to a server behind a CDN, it is possible to poison the CDN cache, severely impacting the availability of a site. An attacker can craft a request, such as https://mysite.com/?/ payload.json, which will be rendered as JSON. If the CDN ignores the query string when determining whether to cache a route, this JSON response could be served to future visitors. An attacker can exploit this to make a site unavailable indefinitely, or continuously poison the cache to maintain unavailability.

Recommendations Update to version 3.16.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-349

Related Identifiers

CVE-2025-27415

GHSA-JVHM-GJRH-3H93

Affected Products

Nuxt

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27415.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27415 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27415 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jvhm-gjrh-3h93 · Vendor Advisory
• https://github.com/nuxt/nuxt · Note
• https://github.com/nuxt/nuxt/security/advisories/GHSA-jvhm-gjrh-3h93 · Note
• https://t.me/cvetracker/19471 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1904299055200743903 · Twitter Post
• https://t.me/poxek/5373 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1903982986875519197 · Twitter Post
• https://twitter.com/SecAideInfo/status/1903389722548007066 · Twitter Post
• https://twitter.com/soltanali0/status/1907829563175923781 · Twitter Post
• https://t.me/pentestingnews/58346 · Telegram Post
• https://twitter.com/CVEnew/status/1902441262038372843 · Twitter Post
• https://twitter.com/zoomeye_team/status/1904117739691921667 · Twitter Post