CVE-2026-61793: nuxt-og-image Unauthenticated SSRF via fonts.path URL Parameter
Summary
CVE-2026-61793: Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter. Affects nuxt-og-image versions >= 6.0.2, < 6.7.0. Fixed in 6.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nuxt-og-image is a module for Nuxt.js that allows developers to generate Open Graph images dynamically. It provides an HTTP endpoint for rendering images based on specified parameters. However, it has a significant security flaw that exposes it to Server-Side Request Forgery (SSRF) attacks due to insufficient URL validation in its configuration.
Vulnerability Detail
The vulnerability arises from the module exposing an unauthenticated HTTP endpoint at /_og/d/** that allows attackers to send crafted requests. The endpoint base64url-decodes and JSON parses a fonts URL segment, passing each fonts[i].path value directly into fetch() without any URL validation. This oversight permits attackers to make arbitrary outbound GET requests to any host accessible from the server, including internal services and cloud metadata endpoints. The vulnerability is particularly dangerous as it can lead to sensitive data exposure, service enumeration, and potential privilege escalation in cloud environments.
How To Fix
Latest published version: 7.0.7 as of 23 Oct 2026
npm install nuxt-og-image@7.0.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7.0
This is the first release that contains the fix.
npm install nuxt-og-image@6.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy or firewall rules to restrict access to the /_og/d/** endpoint until the package is updated. This can help mitigate the risk of SSRF attacks while you prepare for the package update.
Conclusion
The nuxt-og-image package has a critical vulnerability that allows unauthenticated SSRF attacks due to improper URL validation. It is essential to update to the patched version and implement security measures to protect your application from potential exploits.
See every vulnerability recorded for nuxt-og-image →
FAQ
Server-Side Request Forgery (SSRF) is a type of attack where an attacker can send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in real-time.
The impacts include unauthorized access to internal services, exposure of sensitive data, and potential privilege escalation in cloud environments.
Yes, you can implement firewall rules or a reverse proxy to restrict access to the vulnerable endpoint as a temporary measure.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt-og-image.
