CVE-2026-34404
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Mar 31, 2026
CISA due date
—
The record
Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nuxt-og-image | 0 | 6.2.5 |
Related vulnerabilities
- GHSA-c7xp-q6q8-hg76 Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions Same vulnerability
- CVE-2026-44589 Nuxt OG Image generates OG Images with Vue templates in Nuxt. Also affects nuxt-og-image
- GHSA-c2rm-g55x-8hr5 nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) Also affects nuxt-og-image
- GHSA-mg36-wvcr-m75h Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML… Also affects nuxt-og-image
- GHSA-pqhr-mp3f-hrpp Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters Also affects nuxt-og-image
- CVE-2026-34405 Nuxt OG Image generates OG Images with Vue templates in Nuxt. Also affects nuxt-og-image
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400