CVE-2025-27415

Summary

CVE-2025-27415 is a vulnerability affecting Nuxt, an open-source web development framework for Vue.js. Before version 3.16.0, Nuxt sites using a content delivery network (CDN) are at risk of being unavailable if an attacker poisons the CDN cache. By crafting a malicious JSON response through a specific URL query string, an attacker can cause the CDN to serve this response to future visitors, making the site unavailable. This issue is significant because it can impact a site's availability indefinitely, and even permanent unavailability is possible if the cache is reset and an attacker continually sends the crafted request. Version 3.16.0 of Nuxt addresses this problem by properly handling URL query strings in CDN caching.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.