CVE-2026-102527: 
JavaScript vulnerability analysis and mitigation

CVE-2026-102527 is a cache poisoning vulnerability in the Nuxt OG Image module (nuxt-og-image) that allows unauthenticated attackers to inject spoofed Open Graph image content into the server-side cache. The flaw affects versions >= 6.2.5 and < 6.7.0 of the nuxt-og-image npm package. It was discovered by Dmitry Vanin of Positive Technologies, first published to the GitHub Advisory Database on July 22, 2026, and assigned a CVE on October 15, 2026. The vulnerability carries a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data). The vulnerable /_og/d/*.png dynamic route accepted unsigned requests, while the resolvePathCacheKey() function generated cache keys deterministically from the request path, site URL, and normalized rendering options — all of which are observable from public image URLs and HTTP response headers (e.g., cache-control: s-maxage for cacheMaxAgeSeconds, and component/dimension parameters from meta tags and the c_ URL parameter). An attacker could reconstruct the exact cache key using the ohash library with publicly available parameters, then submit a crafted unsigned request to the /_og/d/*.png endpoint with a manipulated title parameter and the derived cacheKey, causing the server to store attacker-controlled image content in the cache slot for a legitimate OG image. The fix in v6.7.0 (PR #638) enables URL signing by default, auto-generating a per-build cryptographic secret so that unsigned or tampered requests are rejected with HTTP 403 before cache slot selection (Github Advisory, GitHub PR #638).

Successful exploitation results in content spoofing: legitimate Open Graph images served to end users (e.g., on social media link previews) are replaced with attacker-controlled imagery. There is no confidentiality or availability impact — the vulnerability is limited to integrity of cached image content. While the scope is constrained to OG image content, the attack could be leveraged for phishing, brand impersonation, or disinformation campaigns by poisoning preview images displayed when links are shared (Github Advisory, Feedly).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires only network access to the application and no authentication, making it trivially reachable for any internet-facing Nuxt application using the affected module versions. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by Dmitry Vanin of Positive Technologies (Github Advisory).

1. Reconnaissance: Identify a target Nuxt application using nuxt-og-image versions >= 6.2.5 and < 6.7.0. Look for /_og/d/*.png URLs in page source or meta tags (e.g., og:image tags).
2. Collect rendering parameters: Inspect the OG image URL to extract parameters such as width, height, component name, and emoji set from the c_ URL parameter. Retrieve cacheMaxAgeSeconds from the cache-control: s-maxage response header of the OG image endpoint.
3. Derive the cache key: Using the ohash npm library, reconstruct the cache key with the following script:

import {hash} from "ohash";
var url = "https://target.com";
var obj = JSON.parse('{"emojis":"noto","extension":"png","width":1200,"height":600,"cacheMaxAgeSeconds":259200,"component":"OgImageBlogPostTakumi"}');
var basePath = '/';
var hashParts = [basePath, url];
if (obj) hashParts.push(hash(obj));
console.log([(!basePath || basePath === '/') ? 'index' : basePath, hash(hashParts)].join(':'));

4. Craft the poisoning request: Send an unsigned HTTP request to /_og/d/*.png with the derived cacheKey and a manipulated title parameter containing attacker-controlled content.
5. Cache slot takeover: The server processes the unsigned request, generates an image with the attacker-supplied title, and stores it in the cache slot corresponding to the legitimate OG image.
6. Impact delivery: Subsequent users or social media crawlers requesting the legitimate OG image URL receive the spoofed image from cache (Github Advisory).

• Network: Unexpected or anomalous HTTP requests to /_og/d/*.png endpoints with unusual title parameters or crafted cacheKey values not matching legitimate application-generated URLs; requests lacking a valid s_ signature suffix in the URL path (pre-patch behavior).
• Logs: Server access logs showing repeated unsigned POST/GET requests to /_og/d/ with varying title or parameter values from external IP addresses; HTTP 200 responses to /_og/d/ requests that do not originate from the application's own defineOgImage() calls.
• File System / Cache: Cached OG image files with unexpected or altered content (e.g., modified titles, logos, or imagery) in the server-side image cache store.
• Application Behavior: Users or social media platforms reporting incorrect or unexpected Open Graph preview images for pages that have not been recently updated (Github Advisory).

The primary remediation is to upgrade nuxt-og-image to version 6.7.0 or later, which enables URL signing by default using an auto-generated per-build secret, causing unsigned or tampered requests to be rejected with HTTP 403 (GitHub Release v6.7.0). For rolling or multi-instance deployments, set a stable explicit secret via the NUXT_OG_IMAGE_SECRET environment variable or ogImage.security.secret config option to ensure URL signatures remain valid across builds (npx nuxt-og-image generate-secret). As a temporary workaround if upgrading is not immediately possible, restrict access to the /_og/d/*.png endpoint at the network or reverse proxy level to trusted sources only (Github Advisory, GitHub PR #638).

The vulnerability was discovered and responsibly disclosed by Dmitry Vanin of Positive Technologies, a well-known security research firm. The fix was implemented by the module maintainer (harlan-zw) and merged on June 24, 2026, prior to the CVE's public NVD publication on October 15, 2026, indicating a coordinated disclosure process. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory and associated pull request (Github Advisory, GitHub PR #638).