Read the docs
TI-2023-27207 Aliases CVE-2023-49800GHSA-q6hx-3m4p-749h

Denial of service by abusing `fetchOptions.retry` in nuxt-api-party

Priority LOW 34CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.

Why it matters now

EPSS 0.00804 56th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nuxt-api-party (johannschopplich): 0.22.1nuxt-api-party (npm): 0.22.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
johannschopplichnuxt-api-partybefore 0.22.10.22.1Patch availableCNA
—nuxt-api-party (npm)before 0.22.10.22.1Patch availableGHSA-q6hx-3m4p-749h
  • nuxt-api-party Vendorjohannschopplich Affected before 0.22.1 Fixed in 0.22.1 Patch available CNA
  • nuxt-api-party (npm) Vendor— Affected before 0.22.1 Fixed in 0.22.1 Patch available GHSA-q6hx-3m4p-749h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:*up to 0.21.3Vulnerablejohannschopplich
  • cpe:2.3:a:johannschopplich:nuxt_api_party:*:*:*:*:*:node.js:*:* Versions up to 0.21.3 Vulnerable ·johannschopplich

Remediation

  • Fix · CNA nuxt-api-party (johannschopplich) Fixed in 0.22.1
  • Fix · GHSA-q6hx-3m4p-749h nuxt-api-party (npm) Fixed in 0.22.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-49800
  2. 2026-10-03 Alias added: GHSA-q6hx-3m4p-749h

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-27206 Server-Side Request Forgery in nuxt-api-party CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences