CVE-2026-61793 Details
Description
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.
A vulnerability in the Nuxt OG Image module, affecting versions 6.0.2 prior to 6.7.0, allows for unauthenticated server-side request forgery (SSRF) via the 'fonts' URL parameter. When the default security settings are used, the module exposes an unauthenticated endpoint that decodes and parses the 'fonts' parameter, then directly fetches the specified font URLs without any validation. This flaw enables attackers to send blind requests to internal services, including loopback and private addresses, while manipulating the response timing and status to probe service availability. The vulnerability is exacerbated by the fact that slow responses can tie up image rendering workers, leading to a denial-of-service condition.
Users can update to Nuxt OG Image version 6.7.0 or later, where this vulnerability has been fixed. The updated version includes proper validation of font URL parameters to prevent SSRF.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e | [email protected] | Source CodeVendor |
| https://github.com/nuxt-modules/og-image/pull/637 | [email protected] | Issue TrackingVendor |
| https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0 | [email protected] | Release NotesVendor |
| https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | [email protected] |
| CWE-749 | Exposed Dangerous Method or Function | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuxt OG Image | >= 6.0.2, < 6.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |