CVE-2026-61793
MediumCVSS 6.9Summary
In nuxt-og-image from 6.0.2 until 6.7.0, the unauthenticated /_og/d/** route is exposed when the documented defaults security.strict = false and security.secret = "" are used, and the fonts parameter is base64url-decoded through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers.
Risk Assessment
An attacker can scan and invoke internal HTTP services, potentially leading to information disclosure or exploitation of vulnerabilities in internal services. Resource exhaustion is also possible by blocking render workers.
Recommendation
Upgrade nuxt-og-image to version 6.7.0 or later. Ensure security.strict and security.secret are properly configured, and restrict access to the /_og/d/** route.
Other vulnerabilities in nuxt-og-image
See all- CVE-2026-34405Medium
Nuxt OG Image before version 6.2.5 has a vulnerability in the image-generation component via URI /_og/d/ (and /og-image/ in older versions) that allows injection of arbitrary attributes into the HTML page body. A fix is available in version 6.2.5.
- CVE-2026-34404High
In Nuxt OG Image prior to version 6.2.5, the lack of restrictions on width and height parameters in the URI /_og/d/ (and /og-image/) allows a DoS attack by generating oversized images.
Original NVD description (English source)
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.