Nuxt OG Image vulnerabilities

In nuxt-og-image from 6.0.2 until 6.7.0, the unauthenticated /_og/d/** route is exposed when the documented defaults security.strict = false and security.secret = "" are used, and the fonts parameter is base64url-decoded through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers.

Nuxt OG Image before version 6.2.5 has a vulnerability in the image-generation component via URI /_og/d/ (and /og-image/ in older versions) that allows injection of arbitrary attributes into the HTML page body. A fix is available in version 6.2.5.

In Nuxt OG Image prior to version 6.2.5, the lack of restrictions on width and height parameters in the URI /_og/d/ (and /og-image/) allows a DoS attack by generating oversized images.