CVE-2025-27415: Nuxt Framework Cache Poisoning DOS Vulnerability

CVE-2025-27415 Overview

CVE-2025-27415 is a CDN cache poisoning vulnerability affecting Nuxt, an open-source web development framework for Vue.js. Prior to version 3.16.0, attackers can craft malicious HTTP requests that exploit how Nuxt handles payload responses, potentially poisoning CDN caches and rendering affected websites completely unavailable to legitimate users.

Critical Impact

This vulnerability enables attackers to perform denial-of-service attacks by poisoning CDN caches, potentially making affected Nuxt sites completely unavailable indefinitely through sustained cache poisoning attacks.

Affected Products

• Nuxt versions prior to 3.16.0
• Nuxt applications deployed behind CDN services that ignore query strings for cache key determination
• Vue.js applications built with vulnerable Nuxt framework versions

Discovery Timeline

• 2025-03-19 - CVE CVE-2025-27415 published to NVD
• 2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-27415

Vulnerability Analysis

This cache poisoning vulnerability exploits a fundamental mismatch between how Nuxt processes requests and how certain CDN configurations determine cache keys. When a Nuxt application receives a request with a specially crafted query string, such as ?/_payload.json, the server incorrectly renders the response as JSON payload data instead of the expected HTML content.

The core issue lies in Nuxt's request handling logic, which interprets certain query string patterns as requests for internal payload data. This behavior, combined with CDN configurations that strip or ignore query strings when computing cache keys, creates a scenario where malicious JSON responses can be cached and served to all subsequent visitors requesting the legitimate HTML page.

The vulnerability is classified under CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data), as the application improperly accepts and processes crafted input that leads to unintended behavior in downstream caching systems.

Root Cause

The root cause stems from Nuxt's internal routing mechanism that handles /_payload.json requests for server-side rendering and hydration purposes. The framework fails to properly validate and restrict when payload responses should be generated, allowing attackers to trigger payload responses through query string manipulation. When combined with CDN caching behavior that normalizes URLs by stripping query parameters, the poisoned JSON response gets associated with the clean URL path.

Attack Vector

The attack exploits the network-accessible nature of web applications deployed behind CDNs. An attacker sends a crafted request to the target Nuxt application with a query string like ?/_payload.json, which causes Nuxt to respond with JSON data instead of HTML. If the CDN in front of the application uses URL path-based cache keys without considering query strings, this JSON response becomes cached for the base URL path.

Subsequent legitimate visitors requesting the same URL receive the cached JSON response instead of the expected HTML page, effectively breaking the website. Attackers can automate this attack by sending poisoning requests at regular intervals matching the CDN cache duration, maintaining persistent unavailability of the targeted site.

The attack requires no authentication or special privileges, can be executed from any network location, and directly impacts site availability without affecting data confidentiality or integrity.

Detection Methods for CVE-2025-27415

Indicators of Compromise

• Unexpected JSON responses being served for HTML page requests
• Anomalous HTTP requests containing ?/_payload.json or similar query string patterns in access logs
• Sudden increases in requests with unusual query string combinations targeting root or high-traffic paths
• User reports of pages displaying raw JSON data instead of rendered content

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests with /_payload.json query string patterns
• Monitor CDN cache hit/miss ratios for unexpected changes that could indicate cache poisoning attempts
• Configure log analysis to alert on unusual query string patterns in requests to Nuxt application endpoints
• Deploy synthetic monitoring to regularly verify that critical pages return expected content types

Monitoring Recommendations

• Enable detailed access logging on CDN and origin servers with query string preservation for forensic analysis
• Set up content-type monitoring alerts to detect when HTML pages unexpectedly serve application/json responses
• Implement real-user monitoring (RUM) to detect client-side rendering failures indicative of cache poisoning
• Create dashboards tracking request patterns to identify potential automated cache poisoning campaigns

How to Mitigate CVE-2025-27415

Immediate Actions Required

• Upgrade Nuxt to version 3.16.0 or later immediately to address this vulnerability
• Review CDN caching configuration to ensure query strings are included in cache key computation
• Purge existing CDN caches after applying the patch to remove any potentially poisoned content
• Implement WAF rules to block suspicious query string patterns while awaiting patch deployment

Patch Information

The vulnerability has been fixed in Nuxt version 3.16.0. Users should update their Nuxt dependency to this version or later. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-jvhm-gjrh-3h93.

To update Nuxt, modify your package.json to specify the patched version and run your package manager's update command.

Workarounds

• Configure CDN to include the full query string in cache key computation to prevent cache poisoning across different request variants
• Implement origin-level request filtering to reject or redirect requests containing /_payload.json in query strings
• Configure cache headers on Nuxt responses to reduce cache duration for sensitive routes, limiting the impact window of successful poisoning attempts
• Deploy edge-level validation to verify response content types match expected values before caching

# Example CDN configuration (Cloudflare-style)
# Include query string in cache key to prevent poisoning
# Cache Rule: Add query string to cache key
cache_key_query_string = "include_all"

# Alternative: Block suspicious patterns at edge
# Firewall Rule: Block requests with payload patterns in query string
http.request.uri.query contains "/_payload"
Action: Block