@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)

nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: OSV:GHSA-2X6F-RP82-PPMJ...

@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)

nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: GHSA-2X6F-RP82-PPMJ...

GHSA-2X6F-RP82-PPMJ Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...

NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes vulnerability discovered by ? in WordPress Npm nuxt-og-image versions = 6.2.5, 6.7.0...

CVE-2026-102527

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)

nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: MEND:CVE-2026-102527...

CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-102527

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-102527

The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...

EUVD-2026-102199

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

CVE-2026-102527: Acceptance of Extraneous Untrusted Data With Trusted Data

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...

PT-2026-115015

Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions 6.2.5 through 6.6.x Description An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint / og/d/.png accepts unsigned requests, and the...

Server-Side Request Forgery (SSRF)

Nuxt OG Image is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled font URLs before performing server-side requests, which allows an unauthenticated attacker to access internal services such as loopback, private, link-local,...

CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...

NPM: Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

NPM: Nuxt OG Image has unauthenticated SSRF via fonts.path URL parameter vulnerability discovered by ? in WordPress Npm nuxt-og-image versions = 6.0.2, 6.7.0...

GHSA-Q8HW-4FVP-9RWV Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...