CVE-2026-102527
MediumCVSS 6.9Summary
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users.
Risk Assessment
An attacker can poison the cache and serve spoofed Open Graph images to users, potentially leading to misinformation or impersonation of legitimate content.
Recommendation
Upgrade Nuxt OG Image to version 6.7.0 or later, which fixes this issue.
Other vulnerabilities in Nuxt OG Image
See all- CVE-2026-61793Medium
In nuxt-og-image from 6.0.2 until 6.7.0, the unauthenticated /_og/d/** route is exposed when the documented defaults security.strict = false and security.secret = "" are used, and the fonts parameter is base64url-decoded through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers.
- CVE-2026-34405Medium
Nuxt OG Image before version 6.2.5 has a vulnerability in the image-generation component via URI /_og/d/ (and /og-image/ in older versions) that allows injection of arbitrary attributes into the HTML page body. A fix is available in version 6.2.5.
- CVE-2026-34404High
In Nuxt OG Image prior to version 6.2.5, the lack of restrictions on width and height parameters in the URI /_og/d/ (and /og-image/) allows a DoS attack by generating oversized images.
Original NVD description (English source)
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS