CVE-2026-102527

Awaiting Analysis Awaiting Analysis - Queue

Nuxt OG Image Cache Poisoning via Title Parameter

Publication date: 2026-10-15

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users. This issue is fixed in version 6.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102527

EUVD

EUVD-2026-102199

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt-modules	og-image	>= 6.2.5, < 6.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-349	The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

Attack-Flow Graph

Executive Summary

This vulnerability is a cache poisoning flaw in the Nuxt OG Image module affecting versions 6.2.5 to 6.7.0. An unauthenticated attacker can manipulate the cache key used for Open Graph images by providing attacker-controlled data through the title parameter. This allows spoofed image content to be served to users by populating the cache slot intended for legitimate images.

Detection Guidance

Check if your Nuxt OG Image module version is between 6.2.5 and 6.7.0. Inspect server logs for unauthorized requests to /_og/d/*.png endpoints. Look for cache poisoning attempts by monitoring cache keys derived from attacker-controlled parameters.

Impact Analysis

The vulnerability allows attackers to replace legitimate Open Graph images with malicious or misleading content. This could deceive users into believing false information, harming trust in your application, or potentially spreading misinformation through shared links on social media platforms.

Compliance Impact

This vulnerability primarily impacts data integrity by allowing spoofed Open Graph images to be served to users. While not directly violating GDPR or HIPAA, it could contribute to non-compliance if spoofed images misrepresent information required for regulatory reporting or user consent. For example, incorrect images might lead to improper documentation of user interactions or consent, which could be relevant under GDPR's accuracy principle or HIPAA's integrity requirements.

Mitigation Strategies

Upgrade to Nuxt OG Image version 6.7.0 or later. Enable URL signing by default or configure a stable signing secret via NUXT_OG_IMAGE_SECRET or nuxt.config.ts. Disable unsigned requests by setting ogImage: { security: { secret: false } } only if necessary.

Hi! I’m here to help you understand CVE-2026-102527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70