CVE-2025-27415 PoC

Nuxt3 cache poisoning

A repository for setting up the cache poisoning vulnerability environment that occurs in nuxt3 >=3.0.0 <3.16.0

Vulnerability Summary

When a CDN is placed in front of a Nuxt server, and the CDN only stores the path excluding URL queries as the cache key, a request to /?/_payload.json is stored with only / as the cache key. Consequently, when another user sends a request to /, the response from the cached _payload.json is returned instead of the normal page.

If an attacker sends a request to /?/_payload.json every time the cache expires, it can trigger a DoS vulnerability where other users cannot receive the normal page.

Detailed explanation and analysis

https://preo123.tistory.com/19

Setup

git clone https://github.com/jiseoung/CVE-2025-27415-PoC.git
cd CVE-2025-27415-PoC
docker-compose up --build

Page Description

• '/' : Page to induce cache poisoning Actually, if you send a request to http://localhost/?/_payload.json to create a cache for the '/' path, when you access http://localhost/, the response for the '/' page is not returned; instead, the contents of the cached _payload.json are returned as JSON.

• '/ex' : Page that automatically performs the cache poisoning attack

  • Target Origin : Path where the cache poisoning attack will be performed

    In this environment, you must use the nuxt-nginx nginx container on the host. Because the attack automation server is built with Flask in a different container, sending to localhost would be recognized as that container's localhost.

  • Cache Interval : The interval (in seconds) to send requests. Set it slightly shorter than the CDN's cache expiry interval.

    In this environment, requests are cached for 60 seconds.