# nuxt-og-image (npm) vulnerabilities

5 known vulnerabilities (4 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/nuxt-og-image

## Advisories (5)

### [CVE-2026-102527](https://cve.now/CVE-2026-102527): Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

- Severity: Medium 6.9
- Published: Oct 15, 2026
- Affected: from 6.2.5, fixed in 6.7.0.

### [CVE-2026-61793](https://cve.now/CVE-2026-61793): Nuxt OG Image has unauthenticated SSRF via \`fonts\[\].path\` URL parameter

- Severity: Medium 6.9
- Published: Sep 17, 2026
- Affected: from 6.0.2, fixed in 6.7.0.

### [CVE-2026-44589](https://cve.now/CVE-2026-44589): nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

- Severity: Low 3.7
- Published: May 14, 2026
- Affected: from 6.2.5, fixed in 6.4.9.

### [CVE-2026-34405](https://cve.now/CVE-2026-34405): Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

- Severity: Medium 6.1
- Published: Mar 31, 2026
- Affected: fixed in 6.2.5.

### [CVE-2026-34404](https://cve.now/CVE-2026-34404): Nuxt OG Image vulnerable to DoS via image generation

- Severity: Medium 6.9
- Published: Mar 31, 2026
- Affected: fixed in 6.2.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/nuxt-og-image
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.