https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T22:39:03.814732+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-61793 fkie_cve-2026-61793 2026-10-05T22:39:03.817803+00:00

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.

 https://vulnerability.circl.lu/vuln/ghsa-q8hw-4fvp-9rwv GHSA-q8hw-4fvp-9rwv — Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter 2026-10-05T22:39:03.817952+00:00

Affected: npm: nuxt-og-image

### Summary `nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).

Under the module's documented default configuration (`security.strict = false`, `security.secret = ""`, `restrictRuntimeImagesToOrigin = false`), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound `GET` requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes `kubelet`, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs).

The chain is **blind** (Satori consumes the response as font bytes and silently discards non-fonts) but a robust **side-channel** exists: the outer HTTP status is `500` when the SSRF target returns `2xx`, and `200` when it fails or returns non-`2xx`. This is sufficient to (a) enumerate live internal services and open ports, (b) confirm IMDSv1 reachability, and (c) detect credential issuance on environments still allowing IMDSv1.

Demonstrated end-to-end on a stock `npm create nuxt@latest` install with the module's documented default usage.

### Detail

#### Endpoint registration (unauthenticated)

The module registers `/_og/d/**` and `/_og/s/**` with no aut…