Nuxt OG Image EUVD-2026-102199

Exploitable only against runtime OG image generation on versions 6.2.5 through 6.6.x where URL signing is not active - specifically deployments that have not set a signing secret, because before 6.7.0 the /_og/d/*.png route accepted unsigned requests (6.7.0 makes signing default-on via an auto-generated per-build secret). Prerendered/static OG images and any deployment that explicitly configured security.secret are not affected. Limiting factors: impact is confined to serving spoofed image content via cache-key collision (no code execution, data theft, or outage), and the attacker must derive the cacheKey from the request path, site URL, and normalized rendering options to overwrite a specific legitimate image slot.

This is a genuine but moderate-severity integrity issue rather than a top-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack path, which raises reachability concern, but impact is deliberately narrow: VC:N/VA:N and only VI:L, i.e. a limited integrity effect (cache poisoning of served OG image content) with no confidentiality or availability loss, consistent with CWE-349 (acceptance of untrusted data). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The headline 6.9 is a CVSS 4.0 score; note the input Tag labels this 'Information Disclosure', which conflicts with the vector - there is no confidentiality impact (VC:N), so this is a content-spoofing/integrity flaw, not disclosure. Overall: a real, easily reachable but low-impact spoofing bug worth patching on publicly exposed Nuxt sites, not a drop-everything critical.

An attacker targets a public Nuxt site using nuxt-modules/og-image (6.2.5-6.6.x) with no configured signing secret. They send unsigned requests to the dynamic /_og/d/*.png route supplying an attacker-controlled title parameter and a derived cacheKey matching a legitimate page's OG image, poisoning that cache slot so social-media crawlers and users subsequently receive the spoofed image. No public exploit code is referenced, but the attack needs no authentication - only crafting the request path and parameters.