Technical impact
Nuxt OG Image creates Open Graph images by rendering Vue templates that can fetch external resources. The denylist introduced in version 6.2.5 was meant to stop malicious requests but it does not cover all IPv6 prefixes and it does not re‑validate redirects, allowing an attacker to cause the server to request arbitrary URLs—including internal or private addresses. The weakness is a classic SSRF flaw (CWE‑918). While the CVSS score is low, the potential to exfiltrate internal data or trigger further attacks remains.
Affected Systems
The vulnerability exists in the nuxt-modules:og-image package below version 6.4.9. Users running 6.2.5 or later but prior to 6.4.9 are affected. The fix is available in 6.4.9 and newer. No other vendors or products are listed as impacted.
Risk and Exploitability
The CVSS score of 3.7 indicates low overall risk, and no EPSS score is published. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a malicious URL to the OG image generator; a successful exploitation could lead to internal host enumeration or traffic interception. The incomplete IPv6 denylist and missing redirect validation make the attack surface larger but still limited to server‑initiated outbound requests.
Github GHSA