CVE-2026-102527: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
Vendor: Nuxt
Product: Nuxt OG Image
Version: 6.2.5
Description: Due to the specifics of caching and key generation in the Open Graph image cache created by the module, an unauthenticated attacker can modify the content of the image (for example, the title parameter) that is delivered to the user.
Impact: Content Spoofing
Vulnerable component: route /_og/d/*.png
Exploitation conditions: Access to the application
Mitigation: Upgrade to 6.7.2 and set a sufficiently secure secret in config ogImage
Researcher: Dmitry Vanin (Positive Technologies)
References
- github.com/advisories/GHSA-2x6f-rp82-ppmj
- github.com/nuxt-modules/og-image/commit/e6c5b53ce7f434ab8cbc91298dccfb2b515c56a5
- github.com/nuxt-modules/og-image/pull/638
- github.com/nuxt-modules/og-image/releases/tag/v6.7.0
- github.com/nuxt-modules/og-image/security/advisories/GHSA-2x6f-rp82-ppmj
- nvd.nist.gov/vuln/detail/CVE-2026-102527
Code Behaviors & Features
Detect and mitigate CVE-2026-102527 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →