Incomplete URL Filtering in Nuxt OG Image by Nuxt Technologies
CVE-2026-44589

3.7LOW

Key Information:

Vendor

Nuxt-modules

Status
Og-image
Vendor
CVE Published:
14 May 2026

What is CVE-2026-44589?

The Nuxt OG Image component, which is responsible for generating Open Graph images using Vue templates, has a vulnerability related to its URL filtering mechanism. Introduced in version 6.2.5, the isBlockedUrl() denylist fails to adequately account for IPv6 prefix variations and lacks necessary redirect re-validation. This can potentially allow unauthorized URLs to bypass security checks, leading to exploitation risks. The issue has been addressed and fixed in version 6.4.9, emphasizing the importance of using the most updated version to maintain security.

Affected Version(s)

og-image >= 6.2.5, < 6.4.9

References

https://github.com/nuxt-modules/og-image/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.