Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the title parameter) that is delivered to the user. Impact: Content Spoofing Vulnerable component: route /og/d/.png Exploitation conditions: Access to the application Mitigation: Upgrade to 6.7.2 and set a sufficiently secure secret in config ogImage Researcher: Dmitry Vanin (Positive Technologies) Research During the previous vulnerability research, it was discovered that version 6.2.5 changed the mechanism for generating cache indexes; it now takes into account the parameters passed during image generation. However, the image is still generated from data transmitted to the attacker. Listing 1. New code for generating indexes in cache In this case, basePath is obtained from the path parameter, resolvedOptions are the normalized settings of…
Recommended action: Upgrade to 6.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fonts[i].path value directly into fetch() server-side without any URL validation (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation). Under the module's documented default configuration (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound GET requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes kubelet, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs). The chain is blind (Satori consumes the response as font bytes and silently discards non-fonts) but a robust side-channel exists: the outer HTTP status is 500 when the SSRF target returns 2xx, and 200…
Recommended action: Upgrade to 6.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. The patch advisory states "Decimal/hexadecimal IP encoding bypasses are also handled" — that part is true (Node's WHATWG URL parser canonicalizes those forms before validation), but the v6.2.5 implementation misses two independent surfaces in the latest release 6.4.8: 1. IPv6 prefix list is incomplete. The IPv6 branch checks only bare === "::1" || startsWith("fc") || startsWith("fd") || startsWith("fe80"). It misses: - [::ffff:7f00:1] — IPv6-mapped IPv4 loopback in pure-hex form (REMAPPEDV4 regex requires dotted-quad). Reaches 127.0.0.1 on a single-stack-IPv4 host with no other primitive needed. - [fec0::/10] (RFC 3879 site-local — deprecated but still routable on legacy networks) - [5f00::/16] (RFC 9602 SRv6 SIDs) - [3fff::/20] (RFC 9637 IPv6 documentation v2) - [64:ff9b:1::/48] (RFC 8215 NAT64 local-use,…
Recommended action: Upgrade to 6.4.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation Description: Incorrect parsing of GET parameters leads to the possibility of HTML injection and JavaScript code injection. Impact: Client-Side JavaScript Execution Exploitation condition: An external user Mitigation: Correct the logic of parsing GET parameters and their subsequent implementation into the generated page. Researcher: Dmitry Prokhorov (Positive Technologies) Research During the analysis of the nuxt-og-image package, which is shipped with the nuxt-seo package, a zero‑day vulnerability was discovered. This research revealed that the image‑generation component by the URI: /og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary attributes into the HTML page body. The vulnerability was reproduced using the standard configuration and the default templates. Listing 1. The content of the configuration file…
Recommended action: Upgrade to 6.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Product: Nuxt OG Image Version: < 6.2.5 CWE-ID: CWE-918: Server-Side Request Forgery Description The image generation endpoint (/og/d/) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors. Impact - Scanning internal ports and services inaccessible from the outside - Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) when verbose error output is enabled Attack Vectors Three distinct vectors were identified, all exploiting the same underlying lack of URL validation: Vector 1: CSS background-image injection via style parameter Vector 2: <img src injection via html parameter When verbose errors are enabled, the response content is leaked in base64-encoded error messages. Vector 3: SVG <image href injection via html parameter Mitigation Fixed in v6.2.5. The image source plugin now blocks…
Recommended action: Upgrade to 6.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Product: Nuxt OG Image Version: 6.1.2 CWE-ID: CWE-404: Improper Resource Shutdown or Release Description: Failure to limit the length and width of the generated image results in a denial of service. Impact: Denial of service Exploitation condition: An external user Mitigation: Implement a limitation on the width and length of the generated image. Researcher: Dmitry Prokhorov (Positive Technologies) Research During the analysis of the nuxt-og-image package, which is shipped with the nuxt-seo package, a zero‑day vulnerability was discovered. This research revealed that the image‑generation component by the URI: /og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. Listing 1. The content of the configuration file nuxt.config.ts Vulnerability…
Recommended action: Upgrade to 6.2.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.