Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Source published

15 Oct 2026 16:55:23 UTC

Source modified

16 Oct 2026 17:13:07 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Source published

Oct 15, 2026, 4:55:23 PM (timezone not stated)

Source modified

Oct 16, 2026, 5:13:07 PM (timezone not stated)

Observed here

9 Nov 2026 05:03:26 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Source published

15 Oct 2026 17:17:08 UTC

Source modified

16 Oct 2026 18:17:14 UTC

Observed here

25 Oct 2026 04:17:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

**Vendor:** Nuxt **Product:** Nuxt OG Image **Version:** 6.2.5 **Description:** Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the `title` parameter) that is delivered to the user. **Impact:** Content Spoofing **Vulnerable component:** route `/_og/d/*.png` **Exploitation conditions:** Access to the application **Mitigation:** Upgrade to 6.7.2 and set a sufficiently secure `secret` in config `ogImage` **Researcher:** Dmitry Vanin (Positive Technologies) ## Research During [the previous vulnerability research](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h), it was discovered that version 6.2.5 changed the mechanism for generating cache indexes; it now takes into account the parameters passed during image generation. However, the image is still generated from data transmitted to the attacker. _Listing 1. New code for generating indexes in cache_ ``` export function resolvePathCacheKey(e: H3Event, path: string, resolvedOptions?: Record<string, any>) { const siteConfig = getSiteConfig(e, { resolveRefs: true, }) const basePath = withoutTrailingSlash(withoutLeadingSlash(normalizeKey(path))) const hashParts: any[] = [ basePath, import.meta.prerender ? '' : siteConfig.url, ] // Hash resolved options (not raw query string) so unknown/extra query params // cannot produce unique cache keys and bypass the cache. if (resolvedOptions) hashParts.push(hash(resolvedOptions)) return [ (!basePath || basePath === '/') ? 'index' : basePath, hash(hashParts), ].join(':') } ``` In this case, `basePath` is obtained from the `_path` parameter, `resolvedOptions` are the normalized settings of the component, for example: _Listing 2. An example of `resolvedOptions`_ ``` {"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageDefaultImageTakumi"} ``` From the analysis of `resolvedOptions`, it was concluded that, in general, all parameters are known either from the direct link to the OG Image or from the server response. ## Vulnerability reproduction 1. Find the route to OG Image. _Figure 1. Demonstration of finding the route to OG Image_ <img width="974" height="361" alt="image" src="https://github.com/user-attachments/assets/d3ee6b54-d545-4a3b-8cbf-f82df99ed4d0" /> 2. Retrieve parameters from the server’s response, especially `cacheMaxAgeSeconds` (`cache-control` header, `s-maxage` key), the other parameters are known from the meta tags as well as from the `c_<component name>` parameter. _Figure 2. Obtaining parameters_ <img width="974" height="245" alt="image" src="https://github.com/user-attachments/assets/84a4cd8b-9281-47ef-b524-0047a0f6077a" /> 3. Generate a cache key using a script. _Listing 3. Srcipt_ ``` import {hash} from "ohash"; var url = "https://contoso.com" var obj = JSON.parse(`{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageBlogPostTakumi"}`) var basePath = '/' var hashParts = [ basePath, url ] if (obj) hashParts.push(hash(obj)) console.log([ (!basePath || basePath === '/') ? 'index' : basePath, hash(hashParts), ].join(':')) ``` 4. Repeat the steps as in [the vulnerability 1](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h), but transmit the obtained `cacheKey` in addition. 5. Thus, the same result as in [the vulnerability 1](https://github.com/nuxt-modules/og-image/security/advisories/GHSA-6c86-prf5-hj4h) was obtained. _Figure 4. Server response_ <img width="974" height="729" alt="image" src="https://github.com/user-attachments/assets/5895c0e8-e497-410d-bef9-f6f2f9649261" /> ## Credits Researcher: Dmitry Vanin (Positive Technologies)

Source published

15 Oct 2026 20:15:27 UTC

Source modified

15 Oct 2026 20:30:08 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Publisher rating · MODERATE