Vulnerability in Nuxt OG Image Affects Unauthenticated Routes and Server Fetching

CVE-2026-61793

What is CVE-2026-61793?

The vulnerability in Nuxt OG Image allows unauthenticated access to the /_og/d/** route due to improper configuration defaults. When 'security.strict' is set to false and 'security.secret' is empty, attacker-controlled inputs can be manipulated to perform unauthorized server-side requests. This occurs through the fonts parameter which is mishandled by loadDefinedFonts, leading to potential data leakage and accessibility of internal services, such as loopback and cloud metadata endpoints. This flaw can impact server resources by occupying rendering processes, allowing attackers to probe service availability without detection. The issue has been addressed in version 6.7.0.

References