CVE-2026-34405

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users.

In nuxt-og-image from 6.0.2 until 6.7.0, the unauthenticated /_og/d/** route is exposed when the documented defaults security.strict = false and security.secret = "" are used, and the fonts parameter is base64url-decoded through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in [email protected] is incomplete, with an incomplete IPv6 prefix list and missing redirect re-validation. This vulnerability is fixed in 6.4.9.

In Nuxt OG Image prior to version 6.2.5, the lack of restrictions on width and height parameters in the URI /_og/d/ (and /og-image/) allows a DoS attack by generating oversized images.