The nuxt-modules og-image package generates Open Graph images using Vue templates in Nuxt. A denylist function intended to block SSRF attacks was introduced in version 6.2.5 but is incomplete due to an incomplete IPv6 prefix list and lack of redirect re-validation, allowing potential SSRF exploitation. This vulnerability is tracked as CVE-2026-44589 and is fixed in version 6.4.9. The CVSS 3.1 score is 3.7 (low), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

The vulnerability allows an attacker to potentially perform SSRF attacks due to incomplete URL blocking logic, which could lead to limited confidentiality exposure. There is no impact on integrity or availability. No known exploits in the wild have been reported. The low CVSS score reflects the limited impact and higher attack complexity.

Upgrade affected installations of nuxt-modules og-image to version 6.4.9 or later, where the vulnerability is fixed. Since this is a self-hosted package, users must apply the update themselves. Patch status is confirmed by the vendor advisory stating the fix is in 6.4.9. No additional mitigations are indicated by the vendor.