CVE-2026-44589 PUBLISHED

nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

Assigner: GitHub_M
Reserved: 06.05.2026 Published: 14.05.2026 Updated: 14.05.2026

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	nuxt-modules
Product	og-image
Versions	Version >= 6.2.5, < 6.4.9 is affected

References

https://github.com/nuxt-modules/og-image/security/advisories/GHSA-c2rm-g55x-8hr5

Problem Types

CWE-918: Server-Side Request Forgery (SSRF) CWE