Description
The isBlockedUrl() denylist introduced in [email protected] to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete.
Recommendation
Update the nuxt-og-image package to the latest compatible version. Followings are version details:
- Affected version(s): >= 6.2.5, < 6.4.9
- Patched version(s): 6.4.9
References
Could your website be exposed too?
SmartScanner can check your website for nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) - CVE-2026-41321
- axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV - CVE-2026-44492
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - @nuxt/webpack-builder - CVE-2026-45670
- Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) - CVE-2026-45670
You might also like:
See something that needs correcting? Let us knowUpdated May 15, 2026