GHSA-2X6F-RP82-PPMJ Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

Nuxt Modules nuxt-og-image trust management issue vulnerability

Nuxt Modules’ nuxt-og-image version 6.2.5 to 6.7.0 contain a trust management issue. This vulnerability arises from the dynamic/og/d/.png routing mechanism accepting unsigned requests. Additionally, the resolvePathCacheKey function can derive cache keys from the request path, site URL, and...

GHSA-Q8HW-4FVP-9RWV Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...

CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-61793: Improper Input Validation

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-34405

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /og/d/ and, in older versions, /og-image/ contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in...

CVE-2026-34404

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /og/d/ and, in older versions, /og-image/ contains a Denial of Service DoS vulnerability. The issue arises because there is no restriction on the width and height...

CVE-2026-34405: Improper Neutralization of Input During Web Page Generation

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /og/d/ and, in older versions, /og-image/ contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. This issue has been patched in...