989 matches found
GHSA-2X6F-RP82-PPMJ Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...
NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes vulnerability discovered by ? in WordPress npm nuxt-og-image versions = 6.2.5, 6.7.0...
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: OSV:GHSA-2X6F-RP82-PPMJ...
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: GHSA-2X6F-RP82-PPMJ...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
EUVD-2026-102199
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
@uxfront/layer-app (>=0.1.0, <=0.2.0), docus (>=5.12.2, <=5.12.3) potentially affected by CVE-2026-102527 via nuxt-og-image (6.6.0)
nuxt-og-image NPM version 6.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on nuxt-og-image and may be impacted: - @uxfront/layer-app =0.1.0, =5.12.2, =5.12.3 Source cves: CVE-2026-102527 Source advisory: MEND:CVE-2026-102527...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527: Acceptance of Extraneous Untrusted Data With Trusted Data
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
PT-2026-115015
Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions 6.2.5 through 6.6.x Description An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint / og/d/.png accepts unsigned requests, and the...
Malicious code in @kibt/www-nuxt-i18n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...
MAL-2026-17498 Malicious code in @kibt/www-nuxt-i18n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...
Server-Side Request Forgery (SSRF)
Nuxt OG Image is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled font URLs before performing server-side requests, which allows an unauthenticated attacker to access internal services such as loopback, private, link-local,...
CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
