CVE-2026-34404: falha de média gravidade em nuxt-modules og-image
Nuxt OG Image vulnerable to DoS via image generation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.3%
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
nuxt-modules · og-imageCVEs relacionadas — nuxt-modules og-image
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61793MEDIUMNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameterEPSS 0.5%CVE-2026-34405MEDIUMNuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributesEPSS 0.2%CVE-2026-102527MEDIUMNuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesEPSS 0.2%CVE-2026-44589LOWnuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)EPSS 0.2%