CVE-2026-44589: nuxt-og-image SSRF Bypass Vulnerability
Summary
CVE-2026-44589: nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect). Affects nuxt-og-image versions >= 6.2.5, < 6.4.9. Fixed in 6.4.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nuxt-og-image is a package designed for generating Open Graph images in Nuxt applications. It simplifies the process of creating dynamic images that can be used for social media sharing, enhancing the visual appeal of shared links. The package is widely used in the Nuxt community due to its ease of integration and functionality. However, it has been found to have a vulnerability that allows Server-Side Request Forgery (SSRF), which can lead to unauthorized access to internal resources.
Vulnerability Detail
The vulnerability arises from an incomplete denylist in the isBlockedUrl() function introduced in nuxt-og-image version 6.2.5. This function is intended to prevent requests to internal IP addresses, but it fails to adequately handle certain IPv6 addresses and does not re-validate URLs after redirects. As a result, an attacker can exploit this flaw to access internal services by crafting specific URLs that bypass the validation checks, potentially leading to data leakage or unauthorized access to sensitive information.
How To Fix
Latest published version: 7.0.7 as of 23 Oct 2026
npm install nuxt-og-image@7.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.4.9
This is the first release that contains the fix.
npm install nuxt-og-image@6.4.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate URLs before passing them to the nuxt-og-image component. Additionally, consider implementing a custom fetch function that disables automatic following of redirects by setting the redirect option to 'manual'. Here is an example of how to modify the fetch call:
async function doResolveSrcToBuffer(src, kind, ctx) {
const response = await fetch(src, { redirect: 'manual' });
if (response.status >= 300 && response.status < 400) {
// Handle redirect response
}
// Continue processing the response
}
Conclusion
The CVE-2026-44589 vulnerability in nuxt-og-image presents a significant risk due to its potential for SSRF attacks. It is crucial for developers using this package to update to the latest version and implement recommended workarounds to secure their applications against this threat.
See every vulnerability recorded for nuxt-og-image →
FAQ
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data leakage.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner.
The potential impacts include unauthorized access to internal services, data leakage, and exposure of sensitive information, especially if internal applications are accessible via loopback addresses.
Yes, a patch is available in version 6.4.9 of nuxt-og-image. It is recommended to update to this version to mitigate the vulnerability.
If you cannot update the package immediately, implement the suggested workarounds, such as manual URL validation and disabling automatic redirects in your fetch calls.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt-og-image.
