Denial of service by abusing `fetchOptions.retry` in nuxt-api-party

published 2023-12-08 2 y ago modified 2026-09-10 1 mo ago also GHSA-q6hx-3m4p-749h , EUVD-2023-3268

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 56%
public exploits: 0; none known

`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow. fetchOptions are obtained directly from the request body. A malicious user can construct a URL known to not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively resulting in a denial of service. This issue has been addressed in version 0.22.1. Users are advised to upgrade. Users unable to upgrade should limit ofetch options.

Patch / fix

fixed in 1

npm nuxt-api-party 0.22.1

Exploit prediction

0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	nuxt-api-party	<0.22.1	0.22.1

Affected products

johannschopplich nuxt-api-party

Classification

Weakness

CWE-674 Uncontrolled Recursion
CWE-400 Uncontrolled Resource Consumption
CWE-787 Out-of-bounds Write

References

github.com /johannschopplich/nuxt-api-party/security/advisories/GHSA-q6hx-3m4p-749h
web, exploit, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2023-49800
advisory
github.com /johannschopplich/nuxt-api-party
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary