Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-44589: nuxt-og-image can be tricked into contacting internal servers
CVE-2026-44589 · published 5 months ago
Summary
The nuxt‑og‑image tool used in GitHub Actions can be fooled into reaching internal network addresses, including IPv6 sites, because its block list is incomplete and it does not check redirects. This could let an attacker make the service request hidden resources on your internal network. Update to version 6.4.9 or later to fix the problem.
What to do
- Update GitHub Actions nuxt-og-image to version 6.4.9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | nuxt-og-image |
>= 6.2.5, < 6.4.9 Fix: upgrade to 6.4.9
|
Original advisory text
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in [email protected] to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published14 May 2026
Updated26 Oct 2026
First seen7 May 2026
Track software like this
Free during beta