GitHub Advisoryadvisory · npm

GHSA-pqhr-mp3f-hrpp Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

MEDIUM Published 2026-03-31 Modified 2026-03-31 Official page ↗
Ecosystem
npm
Packages
nuxt-og-image
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2026-03-31

Affected packages

• npm nuxt-og-image: < 6.2.5 → fixed in 6.2.5

Description

Product: Nuxt OG Image Version: ` injection via `html` parameter ``` GET /_og/d/og.png?html= ``` When verbose errors are enabled, the response content is leaked in base64-encoded error messages. Vector 3: SVG `` injection via `html` parameter ``` GET /_og/d/og.png?html= ``` Mitigation Fixed in v6.2.5. The image source plugin now blocks requests to private IP ranges (IPv4/IPv6), loopback addresses, link-local addresses, and cloud metadata endpoints. Decimal/hexadecimal IP encoding bypasses are also handled. Credits Researcher: Dmitry Prokhorov (Positive Technologies)

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References