{"vulnerability": "CVE-2025-27415", "sightings": [{"uuid": "0ac1de07-a88d-4ea3-b627-6204f6949956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "seen", "source": "https://bsky.app/profile/andranglin.bsky.social/post/3ll4kxlj2cs2h", "content": "", "creation_timestamp": "2025-03-24T10:40:24.450032Z"}, {"uuid": "0a5860c7-4f0d-418f-8ab0-d77d470e12bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lkr2mxpqkl2m", "content": "", "creation_timestamp": "2025-03-19T20:48:48.239747Z"}, {"uuid": "b9c1e224-d722-4b7b-abd0-6a85023fa615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8125", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-27415\n\ud83d\udd25 CVSS Score: 7.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site. An attacker can perform this attack to a vulnerable site in order to make a site unavailable indefinitely. It is also possible in the case where the cache will be reset to make a small script to send a request each X seconds (=caching duration) so that the cache is permanently poisoned making the site completely unavailable. This vulnerability is fixed in 3.16.0.\n\ud83d\udccf Published: 2025-03-19T19:02:04.824Z\n\ud83d\udccf Modified: 2025-03-19T19:02:04.824Z\n\ud83d\udd17 References:\n1. https://github.com/nuxt/nuxt/security/advisories/GHSA-jvhm-gjrh-3h93", "creation_timestamp": "2025-03-19T19:18:19.000000Z"}, {"uuid": "2845dbcb-db6e-42e9-aeab-d02871c236ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "https://t.me/poxek/5373", "content": "CVE-2025-27415: \u041e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u044d\u0448\u0430 \u0432 Nuxt.js\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c Rachid.A (zhero_web_security) \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0432\u0435\u0431-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Nuxt.js, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0442\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u044d\u0448 CDN \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445. \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u2014 \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u0438 \u043f\u043e\u043b\u043d\u0430\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u27a1\ufe0f\u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438\n\u0417\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0440\u0441\u0438\u0438 Nuxt.js 3.0.0\u20133.15.x, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 3.16.0. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0438 \u0437\u0430 CDN, \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u043c query-\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043f\u0440\u0438 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438.\n\nCVSS 7.5 HIGH: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\u27a1\ufe0f\u041a\u0430\u043a \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0430\u0442\u0430\u043a\u0430\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0441\u043b\u0430\u0431\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 URL \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0435. Nuxt \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043f\u0430\u0442\u0442\u0435\u0440\u043d \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f payload-\u043c\u0430\u0440\u0448\u0440\u0443\u0442\u043e\u0432:\n/_payload\\.json|/_payload\\.js\n\n\u041d\u043e \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0432\u0435\u0441\u044c URL, \u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0443\u0442\u044c. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c \u0432\u0438\u0434\u0430:\nGET /?/_payload.json HTTP/1.1\nHost: vulnerable-site.com\n\nCDN \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u0442 query-\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043f\u0440\u0438 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u043a\u043b\u044e\u0447\u0430 \u043a\u044d\u0448\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a / \u0438 /?/_payload.json \u043a\u044d\u0448\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u043f\u043e\u0434 \u043e\u0434\u043d\u0438\u043c \u043a\u043b\u044e\u0447\u043e\u043c. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435:\n\n1. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 /?/_payload.json\n2. \u0421\u0435\u0440\u0432\u0435\u0440 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 JSON \u0432\u043c\u0435\u0441\u0442\u043e HTML: {\"serverRendered\":true,\"data\":null,\"state\":{}}\n3. CDN \u043a\u044d\u0448\u0438\u0440\u0443\u0435\u0442 JSON-\u043e\u0442\u0432\u0435\u0442 \u0434\u043b\u044f \u043f\u0443\u0442\u0438 /\n4. \u0412\u0441\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u044e\u0442 JSON \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b\n\n\u27a1\ufe0f\u041c\u0430\u0441\u0448\u0442\u0430\u0431 \u043f\u043e\u0440\u0430\u0436\u0435\u043d\u0438\u044f\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0412\u0421\u0415 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b Nuxt-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0434\u0430\u0436\u0435 \u0442\u0435, \u0447\u0442\u043e \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442. \u041e\u0431\u044a\u0435\u043a\u0442 \u0431\u0443\u0434\u0435\u0442 \u043f\u0443\u0441\u0442\u044b\u043c, \u043d\u043e \u0432\u0441\u0451 \u0440\u0430\u0432\u043d\u043e \u0432\u0435\u0440\u043d\u0451\u0442\u0441\u044f \u0432 JSON-\u0444\u043e\u0440\u043c\u0430\u0442\u0435, \u043b\u043e\u043c\u0430\u044f \u0440\u0435\u043d\u0434\u0435\u0440\u0438\u043d\u0433.\n\n\u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043e\u043f\u0430\u0441\u043d\u043e \u0434\u043b\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u043d\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u2014 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0444\u0438\u043d\u0442\u0435\u0445-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0433\u0434\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u043f\u0440\u044f\u043c\u044b\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u043e\u0432\u044b\u0435 \u043f\u043e\u0442\u0435\u0440\u0438.\n\n\u27a1\ufe0f\u0410\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0447\u0435\u0440\u0435\u0437 hash\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0441\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 hash-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442 URL:\nGET /#/_payload.json HTTP/1.1\n\nHash \u043d\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430\u043c\u0438, \u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u043a\u0441\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 Nuxt \u0438 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c. \u041f\u0440\u0430\u0432\u0434\u0430, \u043c\u043d\u043e\u0433\u0438\u0435 CDN \u043a\u043e\u0434\u0438\u0440\u0443\u044e\u0442 \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442 hash, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0442\u0430\u043a\u0443.\n\n\ud83d\udd25 PoC\n\ndef attack_loop(origin, cache_sec):\n    target = f\"{origin}/?/_payload.json\"\n    headers = {\"Host\": \"localhost\"}\n    while attacking:\n        requests.get(target, headers=headers)\n        time.sleep(cache_sec)  # \u0418\u043d\u0442\u0435\u0440\u0432\u0430\u043b \u043c\u0435\u043d\u044c\u0448\u0435 TTL \u043a\u044d\u0448\u0430\n\n\u0414\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u043a\u0430\u0436\u0434\u044b\u0435 60 \u0441\u0435\u043a\u0443\u043d\u0434 \u043f\u0440\u0438 TTL \u043a\u044d\u0448\u0430 = 60 \u0441\u0435\u043a \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e DoS.\n\n\u27a1\ufe0f\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c?\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e Nuxt 3.16.0+ \u2014 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044f query-\u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432\n2. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c CDN \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e:\n# \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043b\u044e\u0447 \u043a\u044d\u0448\u0430\nproxy_cache_key \"$scheme$host$request_uri\";  # \u0432\u043c\u0435\u0441\u0442\u043e $uri\n\n# \u0411\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u044b\nif ($args ~* \"/_payload\\.json\") { return 403; }\n3. \u041f\u0440\u0430\u0432\u0438\u043b\u0430 WAF:\nSecRule REQUEST_URI|ARGS_GET \"@rx \\\\?.*_payload\\\\.json\" \\\n    \"id:93327415,phase:1,block,msg:'CVE-2025-27415: Nuxt Cache Poisoning'\"\n\n(http.request.uri contains \"?_payload.json\")\n\n\n\ud83d\udcac \u0414\u043e\u0431\u0430\u0432\u043b\u044e \u043e\u0442 \u0441\u0435\u0431\u044f, \u0447\u0442\u043e \u0432\u0438\u0434\u0435\u043b \u0438\u043d\u0444\u0443 \u043e \u043f\u043e\u0433\u043b\u0430\u0449\u0435\u043d\u0438\u0438 NuxtLabs Vercel'\u043e\u043c, \u0430 \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438\u0438 NextJS. \u0421\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e NextJS \u0442\u043e\u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0437\u0430\u0441\u0432\u0435\u0442\u0438\u043b\u0441\u044f \u0441 cache poisoning CVE-2025-49826. \u0421\u043e\u0432\u043f\u0430\u0434\u0435\u043d\u0438\u0435?))\n\u041a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043f\u044b\u0442\u043a\u0438, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0435 \u043e\u0431\u0440\u0430\u0449\u0430\u0439\u0442\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 ayload ;D\n\n\ud83c\udf1a @poxek | \ud83c\udf1a \u0411\u043b\u043e\u0433 | \ud83d\udcfa YT | \ud83d\udcfa RT | \ud83d\udcfa VK", "creation_timestamp": "2025-07-18T09:58:34.000000Z"}, {"uuid": "fe936683-1c09-47d2-86e3-c8b24eb10ee9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "Telegram/6Txp-NdsgOvnDudD50x-c9VhpDrhwlYTuOYafPDdoFYGJ9g", "content": "", "creation_timestamp": "2025-07-14T15:00:12.000000Z"}, {"uuid": "458a87e9-18b0-466a-8dc1-da68fa48a7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "Telegram/pRtWzbQBlUyWzuUsXiAxBy6O0_nvJ3iAsRbVXeMTCKSM_zk", "content": "", "creation_timestamp": "2025-07-14T15:00:06.000000Z"}, {"uuid": "86d6333c-b7f8-4989-b7c5-b0f0b98e6518", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "Telegram/uWnpZChKZV5yuE-QOEkc-gVigY28ff3y_u3cMKv3pSLH4Sk", "content": "", "creation_timestamp": "2025-07-14T21:00:04.000000Z"}, {"uuid": "00df8b5d-6f07-4244-aebe-5595369f4df7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "published-proof-of-concept", "source": "Telegram/jlMT5pQePgK5GBSq5wMoupEVU9UT7ofYY1WgfO6aSFHSaLY", "content": "", "creation_timestamp": "2025-03-19T22:01:14.000000Z"}, {"uuid": "b439f7af-ad08-44d0-84b7-ef3d367e143e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "seen", "source": "https://t.me/pphm_HackerNews/227", "content": "JavaScript Framework Under Scrutiny: Researchers Reveal Malicious Caching Exploit\n\nA recently disclosed security flaw, identified as CVE-2025-27415, is sparking concern among Nuxt users. The vulnerability can open the door for cache poisoning attacks, allowing adversaries to inject malicious content or alter legitimate data. Given Nuxt\u2019s popularity in building modern web interfaces, developers and organizations are urged to investigate their configurations and implement necessary fixes.\n\n\ud83d\udd17 Read More", "creation_timestamp": "2026-07-20T22:00:03.103004Z"}, {"uuid": "e0de39b7-3773-4057-bb9f-cdef0e1d5026", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-27415", "type": "seen", "source": "https://t.me/pphm_HackerNews/227", "content": "JavaScript Framework Under Scrutiny: Researchers Reveal Malicious Caching Exploit\n\nA recently disclosed security flaw, identified as CVE-2025-27415, is sparking concern among Nuxt users. The vulnerability can open the door for cache poisoning attacks, allowing adversaries to inject malicious content or alter legitimate data. Given Nuxt\u2019s popularity in building modern web interfaces, developers and organizations are urged to investigate their configurations and implement necessary fixes.\n\n\ud83d\udd17 Read More", "creation_timestamp": "2026-07-21T00:00:09.917455Z"}]}