Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

Description

Product: Nuxt OG Image Version: < 6.2.5 CWE-ID: CWE-918: Server-Side Request Forgery

Recommendation

Update the nuxt-og-image package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.2.5
• Patched version(s): 6.2.5

References

• GHSA-pqhr-mp3f-hrpp
• CWE-918
• OWASP 2021-A10

Related Issues

• Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
• lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability - CVE-2024-32964
• @lobehub/chat Server Side Request Forgery vulnerability - CVE-2024-32965
• HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis - CVE-2026-46391

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

nuxt-og-image