211 matches found
CVE-2026-94545
CVE-2026-94545 Next.js next/og Unauthenticated RCE ★ CVE-2026-94545 Next.js next/og SVG injection to native RCE ★ https://github.com/user-attachments/assets/e297b40b-36ad-4a9a-b0c1-a64429bc0160 Overview next/og builds Open Graph images by rendering JSX to an SVG with Satori and then rasterizing...
CVE-2026-102527
A flaw was found in nuxt-og-image. An unauthenticated remote attacker can cause content spoofing by poisoning the application's image cache. Because dynamic image routes accept unsigned requests and generate predictable cache keys, an attacker can submit crafted parameters to overwrite legitimate...
NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
NPM: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes vulnerability discovered by ? in WordPress npm nuxt-og-image versions = 6.2.5, 6.7.0...
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...
GHSA-2X6F-RP82-PPMJ Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image for example, the title parameter that is delivered to the user...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
EUVD-2026-102199
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
CVE-2026-102527
The Nuxt OG Image module is vulnerable to a cache poisoning attack in versions 6.2.5 through 6.7.0 . The root cause is that the dynamic /_og/d/*.png route accepts unsigned requests, and the resolvePathCacheKey() function generates cache keys from request paths and rendering options exposed via im...
PT-2026-115015
Name of the Vulnerable Software and Affected Versions Nuxt OG Image versions 6.2.5 through 6.6.x Description An unauthenticated attacker can perform content spoofing by manipulating the cache of Open Graph images. The dynamic endpoint / og/d/.png accepts unsigned requests, and the...
CVE-2026-102527: Acceptance of Extraneous Untrusted Data With Trusted Data
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /og/d/.png route accepts unsigned requests while resolvePathCacheKey produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server...
Nuxt Modules nuxt-og-image trust management issue vulnerability
Nuxt Modules’ nuxt-og-image version 6.2.5 to 6.7.0 contain a trust management issue. This vulnerability arises from the dynamic/og/d/.png routing mechanism accepting unsigned requests. Additionally, the resolvePathCacheKey function can derive cache keys from the request path, site URL, and...
Next.js Framework 16.2.x / 16.3.x < 16.3.6 RCE
The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - The Node.js ImageResponse implementation from next/og is affected by an upstream Satori vulnerability. Satori does not properly escape certain values before including them in generated SVG output, whi...
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...
GHSA-VCVR-R3JV-PC5J Next.js: Remote Code Execution in next/og ImageResponse
Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...
Next.js: Remote Code Execution in next/og ImageResponse
Impact The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation: tsx import ImageResponse from...