Executive brief
Nuxt OG Image is a module that generates social media preview images for Nuxt websites. Under default configuration, it exposes an unauthenticated endpoint that allows attackers to force the server to make arbitrary outbound HTTP requests to internal networks, cloud metadata services, and localhost. This enables port scanning, cloud credential theft, and probing of internal infrastructure without any authentication required.
Technical details
The vulnerability is a classic Server-Side Request Forgery (SSRF) in the font URL loading path. The module registers unauthenticated endpoints `/_og/d/**` and `/_og/s/**` that parse a `fonts` parameter from the URL. The `fonts` value is base64url-decoded and JSON.parse'd directly into configuration with no validation. Each `fonts[i].path` is then passed to a `fetch()` call in `dist/runtime/server/og-image/bindings/font-assets/node.js` without checking the URL scheme, blocking private/loopback IP ranges, or implementing DNS-rebinding defenses. The vulnerable code uses `new URL(fullPath, origin).href` where fullPath is attacker-controlled absolute URL; the origin parameter is ignored for absolute URLs, allowing fetch to any target. Default config has `security.strict=false` and `security.secret=""`, disabling signature enforcement. Although response bodies are consumed as font data and discarded, a HTTP status-code side-channel exists: targets returning 2xx status cause outer response 500 (font parse fails), while failed connections return 200 (fallback fonts). This boolean oracle enables port enumeration, cloud metadata detection, and service discovery. Fix involves URL validation (scheme allowlist, private IP blocking via DNS lookup+pinning) and flipping security defaults.
Affected products
- nuxt-modules nuxt-og-image >= 6.0.2, < 6.7.0
Timeline
- 2026-09-17: disclosed: GitHub Advisory GHSA-q8hw-4fvp-9rwv published
- 2026-07-22: patched: Affected versions >= 6.0.2, < 6.7.0; version 6.7.0 patched (per GitHub advisory date)