CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.

• CWE-20
• CWE-441
• CWE-749
• CWE-918
• CWE-1188

• https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
• https://github.com/nuxt-modules/og-image/pull/637
• https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0
• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv

Published

Sep 17, 2026

Last Modified

Sep 17, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6178The Betheme theme for WordPress is vulnerable to Stored Cros…6.4
• CVE-2026-61781pg_partman is a PostgreSQL extension that manages partitione…9.9
• CVE-2026-61783Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-6179Stored Cross Site Scripting in NightWolf Penetration Testing…5.4
• CVE-2026-61790Weblate is a web-based continuous localization platform used…4.4
• CVE-2026-61792Weblate is a web-based continuous localization platform used…7.7
• CVE-2026-61794Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-61795Capsule is a multi-tenancy and policy-based framework for Ku…6.8
• CVE-2026-6180A race condition exists in PaperCut MF when processing badge…8.1
• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.3