CVE-2026-44589: Nuxt OG Image SSRF via incomplete IPv6 denylist and redirect bypass

CVE-2026-44589 · Severity: low · CVSS 3.7 · Published 2026-05-14

A vulnerability in the Nuxt OG Image module allows attackers to bypass security filters and access internal network resources. This module is used to generate social media preview images for websites. An attacker could exploit this to view data from private internal services or cloud metadata, potentially leading to the exposure of sensitive configuration or internal system information.

Technologies: nuxt-og-image (npm), Nuxt Og-Image. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-44589 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44589 being exploited in the wild.
How severe is CVE-2026-44589?
Low severity, with a CVSS score of 3.7, published 14 May 2026.
Which products and versions are affected?
nuxt-og-image (npm) >= 6.2.5, < 6.4.9, SEMVER:introduced=6.2.5,fixed=6.4.9; Nuxt Og-Image >= 6.2.5, < 6.4.9.
Is there a fix for CVE-2026-44589?
Yes. nuxt-og-image (npm): upgrade to 6.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44589 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44589?
Check whether you run nuxt-og-image (npm) or Nuxt Og-Image at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt-og-image (npm): upgrade to 6.4.9 or later
    npm install nuxt-og-image@6.4.9

Technical details

The `isBlockedUrl()` function in `nuxt-og-image` implements an incomplete denylist for private IP ranges. Specifically, it fails to account for several IPv6 address formats, including IPv6-mapped IPv4 loopback addresses (e.g., `[::ffff:7f00:1]`) and various RFC-defined local or documentation ranges. Additionally, the module uses `ofetch` to retrieve images, which follows HTTP redirects by default without re-running the validation logic on the redirect target. This allows an attacker to bypass the SSRF protection by providing a URL that redirects to a blocked internal IP. The vulnerability was patched in version 6.4.9.

Affected products

  • Nuxt Modules nuxt-og-image >= 6.2.5, < 6.4.9
  • Nuxt Modules @nuxtjs/og-image >= 6.2.5, < 6.4.9

Identifiers

  • CVE-2026-44589
  • GHSA-c2rm-g55x-8hr5

Timeline

  • 2026-05-02: advisory: GitHub Advisory published
  • 2026-05-07: disclosed: Public disclosure of CVE-2026-44589
  • 2026-05-15: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.