EUVD-2026-81672
GHSA-q8hw-4fvp-9rwv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SSRF against documented defaults (PR:N, AC:L); scope change to internal systems (S:C) with only blind side-channel confidentiality (C:L) and worker-exhaustion availability (A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.
AnalysisAI
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/ image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable when nuxt-og-image (6.0.2-6.6.x) runs with its DOCUMENTED DEFAULTS: security.strict=false, security.secret="" (no request signing), and restrictRuntimeImagesToOrigin=false - meaning any caller who can reach the deployed site can hit the unauthenticated /_og/d/** route and supply a base64url-decoded fonts[].path that the server fetches without validating scheme, origin, resolved IP, or redirects. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, near-default-config exploitable SSRF (real class CWE-918, though NVD assigns the vaguer CWE-20). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade nuxt-og-image to the fixed release 6.7.0 (https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0), which incorporates PR #637 and commit 243cac2228671d3711c2bd65e300c278fcdf5a4e; vendor-released patch: 6.7.0, and the vendor advisory at https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv should be consulted before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today