The vulnerability in Nuxt OG Image allows an attacker to generate overly large images because the width and height inputs are not validated. Sending large values can exhaust memory or disk resources, causing the image generation process to stall or fail and ultimately leading to a Denial of Service against the application. The weakness is a classic input validation flaw, mapped to CWE‑400.

Products affected are the nuxt‑modules:og‑image package, specifically all releases prior to 6.2.5. The vulnerability exists in the /_og/d/ endpoint and, in earlier minor releases, the /og-image/ endpoint. Users running under Node.js using older versions of this module are at risk.

The CVSS score of 6.9 indicates a medium to high severity. The low EPSS (<1%) suggests that exploitation has not been widely observed, and it is not listed in the CISA KEV catalog. A remote attacker can trigger the DoS by crafting an HTTP request to the vulnerable endpoint and supplying large width or height parameters, which is feasible without authentication or additional privileges.