Description
Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the title parameter) that is delivered to the user.
Recommendation
Update the nuxt-og-image package to the latest compatible version. Followings are version details:
- Affected version(s): >= 6.2.5, < 6.7.0
- Patched version(s): 6.7.0
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter - CVE-2026-61793
- nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) - CVE-2026-44589
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
You might also like:
See something that needs correcting? Let us knowUpdated October 15, 2026