A denial of service vulnerability exists in the @nuxt/content module's POST /__nuxt_content/:collection/query endpoint. This endpoint accepts unauthenticated SQL queries and executes them against a local SQLite database after insufficient validation. The validator blocks only a few SQL keywords but does not block resource-intensive SQLite functions like randomblob(), zeroblob(), hex(), or length(). An attacker can exploit this to cause high memory and CPU usage, leading to server-wide denial of service. The vulnerability affects versions >=3.0.0 and <3.15.2 and is fixed in version 3.15.2.