Unauthenticated SSRF in Nuxt OG Image via fonts[].path Parameter (CVE-2026-61793)

What happened

nuxt-og-image exposes a route (/_og/d/**) that, under the package's documented default settings, is reachable without authentication. The route accepts a base64url-encoded 'fonts' parameter that is decoded and passed through to a font-loading mechanism. Attacker-supplied values in fonts[].path are forwarded to a server-side fetch operation that does not validate the URL scheme, origin, resolved network address, or any redirects involved.

Technical cause

The vulnerability stems from improper input validation (CWE-20). Specifically, the decodeOgImageParams function base64url-decodes the fonts parameter, and the resulting fonts[].path values flow unchecked into loadDefinedFonts and then into a font-assets Node.js binding that performs the actual HTTP fetch. Because the scheme, destination, and redirect targets of this fetch are not validated, an attacker can direct the server to make requests to arbitrary internal or external network locations.

Why it matters

This flaw permits blind SSRF requests to loopback addresses, private network ranges, link-local addresses, and cloud metadata endpoints. Even though the response body itself is not necessarily returned to the attacker, differences in response status and response timing can reveal whether an internal service is reachable, enabling network reconnaissance. Additionally, requests to slow or unresponsive targets can occupy OG image rendering workers for the duration of the configured fetch and render timeouts, which could degrade service availability.

Who is affected

Applications using nuxt-og-image are affected when the package's documented default configuration is in use, specifically when security.strict is set to false and security.secret is left as an empty string. Under these defaults, the vulnerable /_og/d/** route is reachable without authentication.

Affected versions

Versions of nuxt-og-image from 6.0.2 up to, but not including, 6.7.0 are affected.

Fixes and mitigation

The issue is fixed in nuxt-og-image version 6.7.0. Site owners and developers using nuxt-og-image should upgrade to this version.

Recommended action

Upgrade nuxt-og-image to version 6.7.0 as soon as practical. If an immediate upgrade is not possible, review your security.strict and security.secret configuration values, since the vulnerability as described relies on the documented default settings (security.strict = false and security.secret = "") to leave the affected route unauthenticated.