CVE-2026-102527 with a CVSS score of 6.9 is a cache poisoning vulnerability in the Nuxt OG Image module, specifically affecting nuxt-og-image (npm) versions >= 6.2.5, < 6.7.0. The flaw occurs in the Open Graph image cache created by the module, particularly the dynamic image route /_og/d/*.png, where cache keys are derived from parameters that an attacker can observe or reconstruct. Because the cache key generation does not sufficiently protect unsigned dynamic image routes, a remote unauthenticated attacker with access to the application can influence the cached image content, such as the title parameter, and cause altered image data to be delivered to users. The attack requires no special privileges or user interaction, and the attacker can exploit it by deriving the cache key from available information such as the path, site URL, resolved component options, and cache-related response values, then causing the poisoned cache entry to be served. The business impact is content spoofing, because users may receive manipulated Open Graph image content that appears to originate from the application, potentially undermining trust, misleading audiences, or supporting deceptive campaigns. The vulnerability affects the integrity of cached image responses while not directly compromising confidentiality or availability.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-102527 with a CVSS score of 6.9 is a cache poisoning vulnerability in the Nuxt OG Image module, specifically affecting nuxt-og-image (npm) versions >= 6.2.5, < 6.7.0. The flaw occurs in the Open Graph image cache created by the module, particularly the dynamic image route /_og/d/*.png, where cache keys are derived from parameters that an attacker can observe or reconstruct. Because the cache key generation does not sufficiently protect unsigned dynamic image routes, a remote unauthenticated attacker with access to the application can influence the cached image content, such as the title parameter, and cause altered image data to be delivered to users. The attack requires no special privileges or user interaction, and the attacker can exploit it by deriving the cache key from available information such as the path, site URL, resolved component options, and cache-related response values, then causing the poisoned cache entry to be served. The business impact is content spoofing, because users may receive manipulated Open Graph image content that appears to originate from the application, potentially undermining trust, misleading audiences, or supporting deceptive campaigns. The vulnerability affects the integrity of cached image responses while not directly compromising confidentiality or availability.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]