Executive brief
A vulnerability in the Nuxt OG Image module allows attackers to bypass security filters and access internal network resources. This module is used to generate social media preview images for websites. An attacker could exploit this to view data from private internal services or cloud metadata, potentially leading to the exposure of sensitive configuration or internal system information.
Technical details
The `isBlockedUrl()` function in `nuxt-og-image` implements an incomplete denylist for private IP ranges. Specifically, it fails to account for several IPv6 address formats, including IPv6-mapped IPv4 loopback addresses (e.g., `[::ffff:7f00:1]`) and various RFC-defined local or documentation ranges. Additionally, the module uses `ofetch` to retrieve images, which follows HTTP redirects by default without re-running the validation logic on the redirect target. This allows an attacker to bypass the SSRF protection by providing a URL that redirects to a blocked internal IP. The vulnerability was patched in version 6.4.9.
Affected products
- Nuxt Modules nuxt-og-image >= 6.2.5, < 6.4.9
- Nuxt Modules @nuxtjs/og-image >= 6.2.5, < 6.4.9
Timeline
- 2026-05-02: advisory: GitHub Advisory published
- 2026-05-07: disclosed: Public disclosure of CVE-2026-44589
- 2026-05-15: patched: Advisory updated with patch information