Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61793 · Microsoft / collected KEV context

EUVD-2026-81672

GHSA-q8hw-4fvp-9rwv

cve-program · CVE-2026-61793

• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
• https://github.com/nuxt-modules/og-image/pull/637
• https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
• https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0

euvd · EUVD-2026-81672

• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
• https://github.com/nuxt-modules/og-image/pull/637
• https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
• https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0

nvd · CVE-2026-61793

• https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
• https://github.com/nuxt-modules/og-image/pull/637
• https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0
• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv

osv · GHSA-q8hw-4fvp-9rwv

• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv
• https://github.com/nuxt-modules/og-image/pull/637
• https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e
• https://github.com/nuxt-modules/og-image
• https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0

No related operational record is retained in the current change model.