CVE-2026-61793

🗓️ 17 Sep 2026 14:48:52Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 32 Views🌐 WEB

Unauthenticated SSRF in nuxt-og-image 6.0.2-6.7.0 via fonts parameter reaches internal services.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-61793	17 Sep 202616:35	–	circl
Cvelist	CVE-2026-61793 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter	17 Sep 202614:48	–	cvelist
EUVD	EUVD-2026-81672	17 Sep 202614:48	–	euvd
Github Security Blog	Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter	17 Sep 202614:48	–	github
Mend	CVE-2026-61793	17 Sep 202614:48	–	mend
NVD	CVE-2026-61793	17 Sep 202615:16	–	nvd
OSV	GHSA-Q8HW-4FVP-9RWV Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter	17 Sep 202614:48	–	osv
Patchstack	NPM: Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter	17 Sep 202614:48	–	patchstack
Positive Technologies	PT-2026-94364	17 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-61793: Improper Input Validation	17 Sep 202600:00	–	rapid7

Vulners

Node

nuxt og_imageRange6.0.2–6.7.0

[
  {
    "vendor": "nuxt-modules",
    "product": "og-image",
    "versions": [
      {
        "version": ">= 6.0.2, < 6.7.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nuxt-modules/og-image/pull/637
github	www.github.com/nuxt-modules/og-image/releases/tag/v6.7.0
github	www.github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
github	www.github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv

Parameter	Position	Path	Description	CWE
fonts[].path	nested	/_og/d/**	SSRF via fonts[].path in /_og/d/**; unvalidated URL fetch performed by font-assets/node.js binding allows access to internal/private services.	CWE-1188, CWE-20, CWE-441, CWE-749, CWE-918

30 Sep 2026 17:51Current

5.9Medium risk

Vulners AI Score5.9

CVSS 46.9

EPSS0.00496

SSVC

nuxt-og-image SSRF fonts parameter Nuxt DoS