Description
nuxt-og-image exposes an unauthenticated HTTP endpoint at /_og/d/** that base64url-decodes and JSON.parses a fonts URL segment, then passes each fonts[i].path value directly into fetch() server-side without any URL validation (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).
Recommendation
Update the nuxt-og-image package to the latest compatible version. Followings are version details:
- Affected version(s): >= 6.0.2, < 6.7.0
- Patched version(s): 6.7.0
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions - CVE-2026-34404
- i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
You might also like:
See something that needs correcting? Let us knowUpdated September 17, 2026