nuxt-og-image

**Vendor:** Nuxt **Product:** Nuxt OG Image **Version:** 6.2.5 **Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the `title` parameter) that is delivered to the user. **Impact:** Content Spoofing **Vulnerable component:** route `/_og/d/*.png` **Exploitation conditions:** Access to the application **Mitigation:** Upgrade to 6.7.2 and set a sufficiently secure `secret` in config `ogImage` **Researcher:** Dmitry Vanin (Positive Technologies) ## Res

CVE: CVE-2026-102527

### Summary `nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation). Under the module's documented default configuration (`security.strict = false`, `security.secret = ""`, `restrictRuntimeImagesToOrigin = false`), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outb

CVE: CVE-2026-61793

## Summary The `isBlockedUrl()` denylist introduced in `nuxt-og-image@6.2.5` to remediate **GHSA-pqhr-mp3f-hrpp** (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. The patch advisory states "Decimal/hexadecimal IP encoding bypasses are also handled" — that part is true (Node's WHATWG URL parser canonicalizes those forms before validation), but the v6.2.5 implementation misses two independent surfaces in the latest release `6.4.8`: 1. **IPv6 prefix list is incomplete.** The IPv6 branch checks only `bare === "::1" || startsWith("fc") || startsWith("fd") || startsWith("fe80"

CVE: CVE-2026-44589

**Product:** Nuxt OG Image **Version:** 6.1.2 **CWE-ID:** [CWE-404](https://cwe.mitre.org/data/definitions/404.html): Improper Resource Shutdown or Release **Description:** Failure to limit the length and width of the generated image results in a denial of service. **Impact:** Denial of service **Exploitation condition:** An external user **Mitigation:** Implement a limitation on the width and length of the generated image. **Researcher:** Dmitry Prokhorov (Positive Technologies) ## Research During the analysis of the nuxt-og-image package, which is shipped with the nuxt-seo package, a zero

CVE: CVE-2026-34404

**Product:** Nuxt OG Image **Version:** 6.1.2 **CWE-ID:** [CWE-79](https://cwe.mitre.org/data/definitions/79.html): Improper Neutralization of Input During Web Page Generation **Description:** Incorrect parsing of GET parameters leads to the possibility of HTML injection and JavaScript code injection. **Impact:** Client-Side JavaScript Execution **Exploitation condition:** An external user **Mitigation:** Correct the logic of parsing GET parameters and their subsequent implementation into the generated page. **Researcher:** Dmitry Prokhorov (Positive Technologies) ## Research During the ana

CVE: CVE-2026-34405

**Product:** Nuxt OG Image **Version:** < 6.2.5 **CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery ## Description The image generation endpoint (`/_og/d/`) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors. ## Impact - Scanning internal ports and services inaccessible from the outside - Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) w