CVE-2026-61793: Nuxt OG Image unauthenticated SSRF in font URL validation

CVE-2026-61793 · Severity: medium · CVSS 4 · Published 2026-09-17

Nuxt OG Image is a module that generates social media preview images for Nuxt websites. Under default configuration, it exposes an unauthenticated endpoint that allows attackers to force the server to make arbitrary outbound HTTP requests to internal networks, cloud metadata services, and localhost. This enables port scanning, cloud credential theft, and probing of internal infrastructure without any authentication required.

Technologies: nuxt-og-image (npm). Vendors: npm.

Quick answers

Is CVE-2026-61793 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61793 being exploited in the wild.
How severe is CVE-2026-61793?
Medium severity, with a CVSS score of 4, published 17 September 2026.
Which products and versions are affected?
nuxt-og-image (npm) >= 6.0.2, < 6.7.0, SEMVER:introduced=6.0.2,fixed=6.7.0.
Is there a fix for CVE-2026-61793?
Yes. nuxt-og-image (npm): upgrade to 6.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61793 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61793?
Check whether you run nuxt-og-image (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nuxt-og-image (npm): upgrade to 6.7.0 or later
    npm install nuxt-og-image@6.7.0

Technical details

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the font URL loading path. The module registers unauthenticated endpoints `/_og/d/**` and `/_og/s/**` that parse a `fonts` parameter from the URL. The `fonts` value is base64url-decoded and JSON.parse'd directly into configuration with no validation. Each `fonts[i].path` is then passed to a `fetch()` call in `dist/runtime/server/og-image/bindings/font-assets/node.js` without checking the URL scheme, blocking private/loopback IP ranges, or implementing DNS-rebinding defenses. The vulnerable code uses `new URL(fullPath, origin).href` where fullPath is attacker-controlled absolute URL; the origin parameter is ignored for absolute URLs, allowing fetch to any target. Default config has `security.strict=false` and `security.secret=""`, disabling signature enforcement. Although response bodies are consumed as font data and discarded, a HTTP status-code side-channel exists: targets returning 2xx status cause outer response 500 (font parse fails), while failed connections return 200 (fallback fonts). This boolean oracle enables port enumeration, cloud metadata detection, and service discovery. Fix involves URL validation (scheme allowlist, private IP blocking via DNS lookup+pinning) and flipping security defaults.

Affected products

  • nuxt-modules nuxt-og-image >= 6.0.2, < 6.7.0

Identifiers

  • CVE-2026-61793
  • GHSA-q8hw-4fvp-9rwv

Timeline

  • 2026-09-17: disclosed: GitHub Advisory GHSA-q8hw-4fvp-9rwv published
  • 2026-07-22: patched: Affected versions >= 6.0.2, < 6.7.0; version 6.7.0 patched (per GitHub advisory date)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.