Nuxt OG Image uses Vue templates to generate Open Graph images and accepts unsigned requests on the dynamic "/_og/d/*.png" route. The cache key is derived from the request path, the site URL, and rendering options exposed through image URLs and server responses. An unauthenticated attacker can craft a title parameter and compute a cacheKey that maps to a legitimate image slot, enabling a cache‑poisoning attack that serves spoofed image content to users. The vulnerability allows an attacker to inject arbitrary image data into the cache, potentially enabling phishing or brand‑spoofing attacks without requiring code execution on the server.

All deployments of the Nuxt OG Image module from version 6.2.5 through 6.6.9 are affected; the issue was resolved starting in 6.7.0. Organizations using the module in any Nuxt project within that version range should verify their installed package version.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% reflects a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation is possible via unauthenticated HTTP requests directed at the open gate—an attacker can supply a derived cacheKey and malicious title in a single GET request to poison the cache used for legitimate Open Graph images. Because authentication is not required, the attack is low-friction, though the limited exploitation likelihood suggests it is not a widespread threat at present.