Read the docs
TI-2026-26689 Aliases CVE-2026-34404GHSA-c7xp-q6q8-hg76

Nuxt OG Image vulnerable to DoS via image generation

Priority HIGH 70CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed og-image (nuxt-modules): 6.2.5nuxt-og-image (npm): 6.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxt-modulesog-imagebefore 6.2.56.2.5Patch availableCNA
—nuxt-og-image (npm)before 6.2.56.2.5Patch availableGHSA-c7xp-q6q8-hg76
  • og-image Vendornuxt-modules Affected before 6.2.5 Fixed in 6.2.5 Patch available CNA
  • nuxt-og-image (npm) Vendor— Affected before 6.2.5 Fixed in 6.2.5 Patch available GHSA-c7xp-q6q8-hg76

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:og_image:*:*:*:*:*:node.js:*:*before 6.2.5Vulnerablenuxt
  • cpe:2.3:a:nuxt:og_image:*:*:*:*:*:node.js:*:* Versions before 6.2.5 Vulnerable ·nuxt

Remediation

  • Fix · CNA og-image (nuxt-modules) Fixed in 6.2.5
  • Fix · GHSA-c7xp-q6q8-hg76 nuxt-og-image (npm) Fixed in 6.2.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34404
  2. 2026-10-03 Alias added: GHSA-c7xp-q6q8-hg76

References

Advisory 2

Other 1

  • TI-2025-18659 Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc CVSS 3.1CRITICAL 9.3
  • TI-2025-33918 mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4) CVSS 3.1HIGH 8.3
  • TI-2026-44231 Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-74652 Cache poisoning in Nuxt OG Image via unsigned image routes CVSS 4.0MEDIUM 6.9
  • TI-2026-32501 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences