Nuxt Content’s public POST /__nuxt_content/:collection/query endpoint permits an attacker to supply arbitrary SQLite queries through an sql field. The absence of comprehensive validation allows the use of expensive SQLite functions such as randomblob(), zeroblob(), hex(), and length(). Executing such queries consumes significant CPU time and memory, blocking the Node.js event loop and preventing all concurrent requests, thereby creating a denial‑of‑service condition.

Versions 3.0.0 through 3.15.2 of the Nuxt Content package are vulnerable when the query endpoint is exposed. Deployments that are fully static and do not expose the server‑side endpoint are not impacted.

With a CVSS score of 7.5 and no mitigation in the affected releases, the vulnerability presents a moderate‑to‑high risk. It is unauthenticated and reachable over HTTP, so an attacker can trigger the DoS with a single request. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the severity and ease of exploitation still warrant immediate action.