What’s Vulnerable › Vulnerabilities

CVE-2026-34404: Nuxt OG Image vulnerable to DoS via image generation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-31 · updated 2026-07-24
• Weakness: CWE-400

Description

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue arises because there is no restriction on the width and height parameters of the generated image. The vulnerability was reproduced using the standard configuration and the default templates. This issue has been patched in version 6.2.5.

Affected products

• nuxt-modules og-image: before 6.2.5 — fixed in 6.2.5

How to fix

Upgrade to a fixed version: nuxt-modules og-image 6.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-c7xp-q6q8-hg76
• https://github.com/nuxt-modules/og-image/security/advisories/GHSA-c7xp-q6q8-hg76

Get alerted when CVE-2026-34404 or the next vulnerability affects your stack