CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
https://github.com/nuxt-modules/og-image/pull/637
https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0
https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv

Configurations

No configuration.

History

17 Sep 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv -~~	() https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv -

17 Sep 2026, 15:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 15:16

Updated : 2026-09-17 16:17

NVD link : CVE-2026-61793

Mitre link : CVE-2026-61793

CVE.ORG link : CVE-2026-61793

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

CWE-749

Exposed Dangerous Method or Function

CWE-918

Server-Side Request Forgery (SSRF)

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-61793", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61793", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-17T15:15:40.104264Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nuxt-modules", "product": "og-image", "versions": [{"status": "affected", "version": ">= 6.0.2, < 6.7.0"}]}]}], "published": "2026-09-17T15:16:48.987", "references": [{"url": "https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt-modules/og-image/pull/637", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv", "source": "security-advisories@github.com"}, {"url": "https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-749"}, {"lang": "en", "value": "CWE-918"}, {"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = \"\" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0."}], "lastModified": "2026-09-17T16:17:33.890", "sourceIdentifier": "security-advisories@github.com"}