---
id: CVE-2026-61793
title: Nuxt OG Image generates OG Images with Vue templates in Nuxt
summary: >-
  Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until
  6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the
  documented defaults security.strict = false and security.secret = "" are used,
  and b…
severity: medium
cvss: 6.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N'
cwe:
  - CWE-20
  - CWE-441
  - CWE-749
  - CWE-918
  - CWE-1188
vendor: nuxt-modules
product: og-image
affected:
  - 'og-image >= 6.0.2, < 6.7.0'
patched:
  - nuxt-og-image 6.7.0
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T16:17:33.890'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61793'
references:
  - url: >-
      https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
    label: security-advisories@github.com
  - url: 'https://github.com/nuxt-modules/og-image/pull/637'
    label: security-advisories@github.com
  - url: 'https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
    label: security-advisories@github.com
  - url: >-
      https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-q8hw-4fvp-9rwv'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-17T15:15:40.104264Z'
cvssSource: cna
aliases:
  - GHSA-q8hw-4fvp-9rwv
ecosystem: npm
ingestedAt: '2026-09-17T15:20:38.996Z'
epss: 0.00496
epssPercentile: 0.39918
---

## Overview

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61793)

Affected packages:

- `nuxt-og-image >= 6.0.2, < 6.7.0`

Patched in:

- `nuxt-og-image 6.7.0`

Source: https://github.com/advisories/GHSA-q8hw-4fvp-9rwv