CVE-2026-102527

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102527
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102527.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102527
Aliases
Published
2026-10-15T16:55:23Z
Modified
2026-10-16T02:47:30Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Details

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-349"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102527.json"
}
References

Affected packages

Git / github.com/nuxt-modules/og-image

Affected ranges

Type
GIT
Repo
https://github.com/nuxt-modules/og-image
Events
Introduced
29b68f15d096f4f62ba0e35c1513bab985843963
Fixed
1af08e84084f01748927284123c7a12d7dfb4945
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "6.2.5"
        },
        {
            "fixed":  "6.7.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v6.*
v6.2.5
v6.2.6
v6.3.0
v6.3.1
v6.3.10
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3.8
v6.3.9
v6.4.0
v6.4.1
v6.4.10
v6.4.11
v6.4.2
v6.4.3
v6.4.4
v6.4.5
v6.4.6
v6.4.7
v6.4.8
v6.4.9
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102527.json"