Nuxt OG Image, a module generating Open Graph images with Vue templates in Nuxt, exposes an unauthenticated route /_og/d/** when default insecure settings are used (security.strict = false and security.secret = ""). The fonts parameter is base64url-decoded and passed to a function that loads fonts via a node.js binding without validating the URL scheme, origin, resolved address, or redirects. This allows attackers to induce server-side requests to internal HTTP services such as loopback, private, link-local, and cloud metadata endpoints. The vulnerability can reveal service reachability through response status and timing differences and may cause denial of service by occupying image render workers during slow fetches. The vulnerability is addressed in version 6.7.0.

An unauthenticated attacker can exploit this vulnerability to perform blind server-side request forgery (SSRF) attacks targeting internal network services, potentially disclosing information about internal infrastructure. Additionally, slow responding internal services can cause denial of service by exhausting OG image rendering resources. There is no indication of remote code execution or direct data compromise beyond service reachability and resource exhaustion.

Upgrade to nuxt-modules og-image version 6.7.0 or later, where this vulnerability is fixed. Until then, avoid using the insecure default settings security.strict = false and security.secret = "". Validate and restrict input parameters to prevent untrusted URLs from being fetched. Patch status is confirmed fixed in version 6.7.0.