CVE-2026-34404

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34404
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34404.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34404
Aliases
Published
2026-03-31T21:16:07.824Z
Modified
2026-04-10T05:43:24.041817Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Nuxt OG Image vulnerable to DoS via image generation
Details

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34404.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nuxt-modules/og-image

Affected ranges

Type
GIT
Repo
https://github.com/nuxt-modules/og-image
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29b68f15d096f4f62ba0e35c1513bab985843963
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.2.5"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.1.0
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.6.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.2
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.17
v1.4.18
v1.4.19
v1.4.2
v1.4.20
v1.4.21
v1.4.22
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v2.*
v2.0.0
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.10
v2.0.0-beta.11
v2.0.0-beta.12
v2.0.0-beta.13
v2.0.0-beta.14
v2.0.0-beta.15
v2.0.0-beta.16
v2.0.0-beta.17
v2.0.0-beta.18
v2.0.0-beta.19
v2.0.0-beta.2
v2.0.0-beta.20
v2.0.0-beta.21
v2.0.0-beta.22
v2.0.0-beta.23
v2.0.0-beta.24
v2.0.0-beta.25
v2.0.0-beta.26
v2.0.0-beta.27
v2.0.0-beta.28
v2.0.0-beta.29
v2.0.0-beta.3
v2.0.0-beta.30
v2.0.0-beta.31
v2.0.0-beta.32
v2.0.0-beta.33
v2.0.0-beta.34
v2.0.0-beta.35
v2.0.0-beta.36
v2.0.0-beta.37
v2.0.0-beta.38
v2.0.0-beta.39
v2.0.0-beta.4
v2.0.0-beta.40
v2.0.0-beta.41
v2.0.0-beta.42
v2.0.0-beta.43
v2.0.0-beta.44
v2.0.0-beta.45
v2.0.0-beta.46
v2.0.0-beta.47
v2.0.0-beta.48
v2.0.0-beta.49
v2.0.0-beta.5
v2.0.0-beta.50
v2.0.0-beta.51
v2.0.0-beta.52
v2.0.0-beta.53
v2.0.0-beta.54
v2.0.0-beta.55
v2.0.0-beta.56
v2.0.0-beta.57
v2.0.0-beta.58
v2.0.0-beta.59
v2.0.0-beta.6
v2.0.0-beta.60
v2.0.0-beta.61
v2.0.0-beta.62
v2.0.0-beta.63
v2.0.0-beta.64
v2.0.0-beta.65
v2.0.0-beta.66
v2.0.0-beta.67
v2.0.0-beta.68
v2.0.0-beta.69
v2.0.0-beta.7
v2.0.0-beta.70
v2.0.0-beta.71
v2.0.0-beta.72
v2.0.0-beta.8
v2.0.0-beta.9
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.25
v2.0.26
v2.0.27
v2.0.28
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.0-beta.0
v2.1.1
v2.1.2
v2.1.3
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v3.*
v3.0.0
v3.0.0-beta.0
v3.0.0-beta.1
v3.0.0-beta.10
v3.0.0-beta.11
v3.0.0-beta.12
v3.0.0-beta.13
v3.0.0-beta.14
v3.0.0-beta.15
v3.0.0-beta.16
v3.0.0-beta.17
v3.0.0-beta.18
v3.0.0-beta.19
v3.0.0-beta.2
v3.0.0-beta.20
v3.0.0-beta.21
v3.0.0-beta.22
v3.0.0-beta.23
v3.0.0-beta.24
v3.0.0-beta.25
v3.0.0-beta.26
v3.0.0-beta.27
v3.0.0-beta.28
v3.0.0-beta.29
v3.0.0-beta.3
v3.0.0-beta.30
v3.0.0-beta.31
v3.0.0-beta.32
v3.0.0-beta.33
v3.0.0-beta.34
v3.0.0-beta.35
v3.0.0-beta.36
v3.0.0-beta.37
v3.0.0-beta.38
v3.0.0-beta.39
v3.0.0-beta.4
v3.0.0-beta.40
v3.0.0-beta.41
v3.0.0-beta.42
v3.0.0-beta.43
v3.0.0-beta.44
v3.0.0-beta.45
v3.0.0-beta.46
v3.0.0-beta.47
v3.0.0-beta.48
v3.0.0-beta.49
v3.0.0-beta.5
v3.0.0-beta.50
v3.0.0-beta.51
v3.0.0-beta.52
v3.0.0-beta.53
v3.0.0-beta.54
v3.0.0-beta.55
v3.0.0-beta.56
v3.0.0-beta.57
v3.0.0-beta.58
v3.0.0-beta.59
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-beta.8
v3.0.0-beta.9
v3.0.0-rc.0
v3.0.0-rc.1
v3.0.0-rc.10
v3.0.0-rc.11
v3.0.0-rc.12
v3.0.0-rc.13
v3.0.0-rc.14
v3.0.0-rc.15
v3.0.0-rc.16
v3.0.0-rc.17
v3.0.0-rc.18
v3.0.0-rc.19
v3.0.0-rc.2
v3.0.0-rc.20
v3.0.0-rc.21
v3.0.0-rc.22
v3.0.0-rc.23
v3.0.0-rc.24
v3.0.0-rc.25
v3.0.0-rc.26
v3.0.0-rc.27
v3.0.0-rc.28
v3.0.0-rc.29
v3.0.0-rc.3
v3.0.0-rc.30
v3.0.0-rc.31
v3.0.0-rc.32
v3.0.0-rc.33
v3.0.0-rc.34
v3.0.0-rc.35
v3.0.0-rc.36
v3.0.0-rc.37
v3.0.0-rc.38
v3.0.0-rc.39
v3.0.0-rc.4
v3.0.0-rc.40
v3.0.0-rc.41
v3.0.0-rc.42
v3.0.0-rc.43
v3.0.0-rc.44
v3.0.0-rc.45
v3.0.0-rc.46
v3.0.0-rc.47
v3.0.0-rc.48
v3.0.0-rc.49
v3.0.0-rc.5
v3.0.0-rc.50
v3.0.0-rc.51
v3.0.0-rc.52
v3.0.0-rc.53
v3.0.0-rc.54
v3.0.0-rc.55
v3.0.0-rc.56
v3.0.0-rc.57
v3.0.0-rc.58
v3.0.0-rc.59
v3.0.0-rc.6
v3.0.0-rc.60
v3.0.0-rc.61
v3.0.0-rc.62
v3.0.0-rc.63
v3.0.0-rc.64
v3.0.0-rc.65
v3.0.0-rc.66
v3.0.0-rc.67
v3.0.0-rc.68
v3.0.0-rc.69
v3.0.0-rc.7
v3.0.0-rc.8
v3.0.0-rc.9
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.2.0
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.1.1
v5.1.10
v5.1.11
v5.1.12
v5.1.13
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.1.7
v5.1.8
v5.1.9
v6.*
v6.0.0
v6.0.0-beta.1
v6.0.0-beta.10
v6.0.0-beta.11
v6.0.0-beta.12
v6.0.0-beta.13
v6.0.0-beta.14
v6.0.0-beta.15
v6.0.0-beta.16
v6.0.0-beta.17
v6.0.0-beta.18
v6.0.0-beta.19
v6.0.0-beta.2
v6.0.0-beta.20
v6.0.0-beta.21
v6.0.0-beta.22
v6.0.0-beta.23
v6.0.0-beta.24
v6.0.0-beta.25
v6.0.0-beta.26
v6.0.0-beta.27
v6.0.0-beta.28
v6.0.0-beta.29
v6.0.0-beta.3
v6.0.0-beta.30
v6.0.0-beta.31
v6.0.0-beta.32
v6.0.0-beta.33
v6.0.0-beta.34
v6.0.0-beta.35
v6.0.0-beta.36
v6.0.0-beta.37
v6.0.0-beta.38
v6.0.0-beta.39
v6.0.0-beta.4
v6.0.0-beta.40
v6.0.0-beta.41
v6.0.0-beta.42
v6.0.0-beta.43
v6.0.0-beta.44
v6.0.0-beta.45
v6.0.0-beta.46
v6.0.0-beta.47
v6.0.0-beta.48
v6.0.0-beta.5
v6.0.0-beta.6
v6.0.0-beta.7
v6.0.0-beta.8
v6.0.0-beta.9
v6.0.1
v6.0.2
v6.0.3
v6.0.4
v6.0.5
v6.0.6
v6.0.7
v6.1.0
v6.1.1
v6.1.2
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34404.json"