Skip to main content
cve.nowby Sazabi
← npm
npmPackage

nuxt-og-image

5 known vulnerabilities (4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 4 medium, 1 low
Registry
npm

Advisories 5

  • CVE-2026-102527Medium 6.9

    Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

    Affected: from 6.2.5, fixed in 6.7.0.

  • CVE-2026-61793Medium 6.9

    Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

    Affected: from 6.0.2, fixed in 6.7.0.

  • nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

    Affected: from 6.2.5, fixed in 6.4.9.

  • CVE-2026-34405Medium 6.1

    Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

    Affected: fixed in 6.2.5.

  • CVE-2026-34404Medium 6.9

    Nuxt OG Image vulnerable to DoS via image generation

    Affected: fixed in 6.2.5.