Threat Intelligence Report — CVE-2026-61793

Executive Summary

CVE-2026-61793 is a server-side request forgery (SSRF) vulnerability in nuxt-og-image, a Nuxt module that generates Open Graph images from Vue templates. From version 6.0.2 until 6.7.0, deployments using the documented defaults security.strict = false and security.secret = "" expose an unauthenticated /_og/d/** route that decodes attacker-supplied font parameters and uses them to drive a server-side HTTP fetch without validating URL scheme, origin, resolved address, or redirects. An unauthenticated remote attacker can coerce the server into making blind requests to loopback, private, link-local, and cloud metadata endpoints, enabling internal network reconnaissance and resource-exhaustion attacks against OG image render workers.

Technical Analysis

nuxt-og-image renders Open Graph images on the server using Vue templates. The vulnerable code path is reachable through the /_og/d/** route, which is exposed without authentication when the module is configured with its documented defaults security.strict = false and security.secret = "".

Request parameters supplied to this route are processed by decodeOgImageParams, which base64url-decodes the serialized parameter payload — including the fonts parameter. Attacker-controlled values in fonts[].path are passed into loadDefinedFonts, and from there into the font-assets binding implemented in font-assets/node.js. That binding performs a server-side fetch of the supplied font URL.

Critically, per the NVD description, this fetch does not validate:

• the URL scheme (e.g., permitting schemes beyond expected HTTP(S) file retrieval),
• the origin or host,
• the resolved IP address (no blocking of loopback, RFC1918 private, or link-local ranges), or
• the handling of redirects.

This is a classic Server-Side Request Forgery (SSRF) chain, classified by the CNA data as CWE-20 (Improper Input Validation) — the missing validation on the fetch target is the root cause. The attacker controls the destination of a request originating from the Nuxt server, which typically sits behind the public edge and inside trusted network segments.

Two exploitation primitives follow directly from the described behavior:

1. Blind SSRF / internal service enumeration. Because responses are not returned to the attacker verbatim, the attacker infers reachability from differences in the outer response status and timing. A reachable, responsive internal service produces a distinguishable response from an unreachable one.
2. Resource exhaustion / worker starvation. The server-side fetch respects configured fetch and render timeouts. Slow or non-responding targets therefore hold OG image render workers for the duration of those timeouts. Repeated requests against slow targets can exhaust the worker pool and degrade or deny legitimate OG image generation, and by extension any application path depending on it.

The vulnerable route is unauthenticated only under the documented insecure defaults. Deployments that set security.strict = true and a non-empty security.secret are not exposed through the route as described, because the route is gated by those settings.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (SSRF via unvalidated URL fetch) and the specific data points named in the NVD description.

1) Reconnaissance / target identification. The attacker identifies internet-facing Nuxt applications running nuxt-og-image in the affected version range (6.0.2 through 6.6.x). Practical fingerprinting includes probing for the /_og/d/** route and, where module configuration leaks via other means, confirming the documented insecure defaults (security.strict = false, security.secret = ""). Because the route is unauthenticated under those defaults, no credentials are required.

2) Triggering the flaw. The attacker crafts a request to the /_og/d/** route containing a base64url-encoded fonts parameter. Inside that parameter, the attacker sets fonts[].path to an internal URL of interest. When decodeOgImageParams decodes the parameter, the crafted fonts[].path value flows through loadDefinedFonts into the font-assets/node.js binding, which issues the server-side fetch. Because the fetch validates neither scheme, origin, resolved address, nor redirects, the attacker controls the destination.

3) Payload / execution method (vulnerability class level). The attacker substitutes the font URL destination with internal targets:

• http://127.0.0.1:<port>/... (loopback services),
• RFC1918 private ranges (internal admin panels, microservices),
• link-local addresses (e.g., 169.254.0.0/16),
• cloud metadata endpoints (IMDS-style addresses),
• other internal HTTP services.

For blind targets, the attacker does not require the response body. Reachability is determined from differences in the outer response status and timing of the OG image request. Iterating fonts[].path across ports and hosts therefore yields an internal port/service map. The lack of redirect validation is significant: a permitted redirect permits reaching a target that a naive string filter on the initial URL might have intended to block.

4) Post-exploitation impact. The immediate impact is internal network reconnaissance and service reachability disclosure. Where reachable internal HTTP services perform actions on GET requests (or permit redirect-based chaining), the SSRF can extend the attack surface into those services. Independently, by pointing fonts[].path at slow or non-responsive hosts, the attacker occupies render workers for the configured fetch/render timeout, degrading or denying the OG image rendering capability.

Impact Assessment

Confidentiality (C:L): The vulnerability provides a blind oracle over internal reachability via response status and timing differences, enabling mapping of loopback, private, link-local, cloud metadata, and other internal HTTP services. Response content is not returned directly per the description, keeping confidentiality impact bounded but non-trivial.

Integrity (I:N): No write or data-modification primitive is described. Impact is information exposure and resource consumption, not data tampering.

Availability (A:L): Slow-target fetches hold render workers for the configured timeouts. Sustained requests can degrade or exhaust the OG render worker pool. The NVD description explicitly notes this contention effect.

Scope (S:C): The vulnerable component (the Nuxt OG image fetch) is used as a conduit to affect resources beyond its own security scope — internal services and cloud metadata on the host's network. This justifies a Scope:Changed assessment.

Network/attack vector (AV:N): The /_og/d/** route is reachable over the network.

Privileges (PR:N) / User interaction (UI:N): The route is unauthenticated under the documented defaults; no user interaction is required.

Business context. OG image generation is commonly used on marketing sites, documentation portals, and CMS frontends — frequently internet-facing. A modest-SSRF here yields an internal network map from the vantage point of an application tier that typically has broad network egress within its VPC. Where cloud metadata is reachable, credential/identity exposure on the instance becomes a follow-on risk.

Note: No CVSS score is assigned in the intelligence data provided. The vector above is a reasoned assessment from the described mechanics, not a vendor-assigned score; treat it as analyst-derived.

Detection Guidance

Sigma Rule

title: Nuxt OG Image SSRF via /_og/d Route (CVE-2026-61793)
id: 7d9b1e42-6a3c-4f10-9c2b-ogimage61793
status: experimental
description: Detects unauthenticated access to the nuxt-og-image /_og/d route carrying a base64url-encoded fonts parameter, consistent with CVE-2026-61793 SSRF attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61793
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|startswith: '/_og/d/'
  selection_fonts:
    cs-uri-query|contains: 'fonts'
  condition: selection_route and selection_fonts
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate OG image rendering with custom fonts (rare via /_og/d in strict mode)
level: high

YARA Rule

rule CVE_2026_61793_NuxtOGImage_SSRF
{
    meta:
        description = "Detects nuxt-og-image SSRF indicators (/_og/d route and vulnerable config defaults) in web artifacts and configuration"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61793"
        date = "2026-01-01"
        severity = "high"

    strings:
        $route   = "/_og/d/" ascii wide
        $params  = "decodeOgImageParams" ascii
        $load    = "loadDefinedFonts" ascii
        $bind    = "font-assets/node.js" ascii
        $strict  = "strict" ascii
        $secret  = "secret" ascii
        $fonts   = "fonts" ascii

    condition:
        (uint16(0) == 0x213C or true) and
        (
            ($route and $fonts) or
            ($params and $load) or
            ($bind and $route)
        ) and
        ($strict and $secret)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61793 nuxt-og-image SSRF attempt via /_og/d fonts parameter"; flow:established,to_server; http.uri; content:"/_og/d/"; http.uri; content:"fonts"; http.header; content:"GET"; pcre:"/\/_og\/d\/[^\s]*/Ui"; classtype:attempted-recon; sid:6179301; rev:1; reference:cve,2026-61793; metadata:service http;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "GET" and url.path like "/_og/d/*" ]
  [ network where http.request.method == "GET" and url.query like "*fonts*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval route=uripath, qry=uri_query
| where like(route, "/_og/d/%") AND like(qry, "%fonts%")
| rex field=qry "fonts=\s*(?<fonts_blob>[A-Za-z0-9_-]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses values(clientip) as clients by route, fonts_blob
| where count > 5
| table first_seen, last_seen, clients, route, statuses, count, fonts_blob
| sort - count

Wazuh OSSEC Rule

<group name="web,cve_2026_61793,ssrf,">
  <rule id="617931" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/_og/d/</field>
    <field name="url">fonts</field>
    <description>CVE-2026-61793: Possible nuxt-og-image SSRF attempt via /_og/d route with fonts parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was available from any tracked source. The NVD description states the issue is fixed in version 6.7.0; verify this fix directly from the upstream nuxt-og-image project before relying on it, and treat affected deployments as unpatched until confirmed.

1) Immediate mitigations (apply now, before patch verification):

• Set module security to hardened mode: configure security.strict = true and provide a non-empty security.secret. The described SSRF route is exposed only under the insecure defaults (strict = false, secret = "").
• Block or restrict network access from the Nuxt server to loopback, RFC1918 private ranges, link-local (169.254.0.0/16), and cloud metadata endpoints at the egress firewall, VPC security group, or egress proxy level.
• If the OG image functionality is not required, disable the module or remove the /_og/d/** route from public exposure.
• If the route must remain public, place it behind authentication or an edge WAF rule that rejects requests with a fonts parameter targeting non-public hosts, and that flags redirect responses (3xx) to internal ranges.
• Rate-limit /_og/d/** and set aggressive fetch/render timeouts to reduce the worker-starvation window.

2) Patch / upgrade steps:

• Upgrade nuxt-og-image to version 6.7.0 or later once the fix is verified from the authoritative vendor source.
• Re-run dependency resolution and confirm the locked version across all environments.
• After upgrade, re-test that the /_og/d/** route no longer permits unvalidated fetches (scheme, origin, resolved address, and redirects should all be enforced).
• Re-audit configuration to ensure security.strict remains true and security.secret is set post-upgrade.

3) Long-term hardening:

• Add SSRF allow-listing in the application layer: resolve the target host, block private/loopback/link-local/cloud-metadata ranges, restrict schemes to expected values (https), and disable or validate redirects.
• Enforce outbound egress filtering as a standing control so any future SSRF in the application tier cannot reach internal metadata services.
• Adopt secure-by-default configuration review so modules documented with permissive defaults are tightened before deployment.
• Monitor /_og/d/** access with the detection content above and alert on anomalous internal-host probing patterns and status/timing-based enumeration.

References

• NVD — CVE-2026-61793: https://nvd.nist.gov/vuln/detail/CVE-2026-61793
• nuxt-og-image project (upstream fix in 6.7.0 per NVD description): https://github.com/nuxt-modules/og-image
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV Catalog (CVE-2026-61793 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild & threat actor activity: No known threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-61793 in the data provided. CISA KEV status: NO. EPSS: not yet scored by FIRST.org. No public PoC, Nuclei template, or exploit code was identified at time of writing. No public PoC available; the attack chain in this report is inferred from the vulnerability class and the technical details explicitly stated in the NVD description.