CVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt.
Published Oct 15, 2026 · updated Oct 15, 2026
**Vendor:** Nuxt **Product:** Nuxt OG Image **Version:** 6.2.5 **Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the parameter) that is delivered to the user. **Impact:** Content Spoofing **Vulnerable component:** route **Exploitation conditions:** Access to the application **Mitigation:** Upgrade to 6.7.2 and set a sufficiently secure in config **Researcher:** Dmitry Vanin (Positive Technologies) ## Research During [the previous vulnerability research](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h), it was discovered that version 6.2.5 changed the mechanism for generating cache indexes; it now takes into account the parameters passed during image generation. However, the image is still generated from data transmitted to the attacker. _Listing 1. New code for generating indexes in cache_ In this case, is obtained from the parameter, are the normalized settings of the component, for example: _Listing 2. An example of _ From the analysis of , it was concluded that, in general, all parameters are known either from the direct link to the OG Image or from the server response. ## Vulnerability reproduction 1. Find the route to OG Image. _Figure 1. Demonstration of finding the route to OG Image_ 2. Retrieve parameters from the server’s response, especially ( header, key), the other parameters are known from the meta tags as well as from the parameter. _Figure 2. Obtaining parameters_ 3. Generate a cache key using a script. _Listing 3. Srcipt_ 4. Repeat the steps as in [the vulnerability 1](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h), but transmit the obtained in addition. 5. Thus, the same result as in [the vulnerability 1](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h) was obtained. _Figure 4. Server response_ ## Credit
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · NIST NVD
Detected
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title param
Oct 15, 2026 · GitHub Advisory Database
Fix available
nuxt-og-image fixed in 6.7.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
nuxt-og-image fixed in 6.7.0
Oct 15, 2026 · GitHub Advisory Database
Updated
**Vendor:** Nuxt **Product:** Nuxt OG Image **Version:** 6.2.5 **Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the parameter) that is delivered to the user. **Impact:** Content Spoofing **Vulnerable component:** route **Exploitation conditions:** Ac
Affected
- npm nuxt-og-image6.2.5 → 6.7.0
Sources
- CVE.orgVulnerability recordCVE-2026-102527
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-2x6f-rp82-ppmj
GitHub Advisory Database record mirrored by OSV.
github.com - NIST NVDVulnerability recordCVE-2026-102527
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image U
nvd.nist.gov - OSV.devPackage advisoryGHSA-2x6f-rp82-ppmj
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
osv.dev