CVE-2026-34404: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34404 is a Denial of Service (DoS) vulnerability in the Nuxt OG Image package (nuxt-og-image) for Node.js, caused by unrestricted width and height parameters in the image-generation endpoint. Discovered by researcher Dmitry Prokhorov of Positive Technologies and published on March 28, 2026, it affects all versions of nuxt-og-image prior to 6.2.5. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-404 (Improper Resource Shutdown or Release): the image-generation component exposed at /_og/d/ (and /og-image/ in older versions) accepts arbitrary integer values for width and height query parameters without any server-side validation or upper-bound enforcement. An attacker can craft a simple HTTP GET request such as GET /_og/d/og.png?width=20000&height=20000 to force the server to allocate excessive memory and video memory during image rendering, ultimately exhausting available resources. No authentication, special privileges, or user interaction is required, and the vulnerability was confirmed reproducible against the standard configuration using default Vue templates (Security Advisory, GitHub Advisory).

Successful exploitation results in server memory and video memory exhaustion, causing the Nuxt application to become unresponsive and denying service to legitimate users. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Because the endpoint is publicly accessible without authentication, any internet-facing Nuxt application using the nuxt-og-image or nuxt-seo packages (which bundles nuxt-og-image) is at risk of complete service disruption from a single attacker or automated script (GitHub Advisory, Security Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042–0.063%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the trivial nature of exploitation — a single unauthenticated HTTP GET request — means the barrier to abuse is extremely low for any attacker who identifies a vulnerable target.

1. Reconnaissance: Identify internet-facing Nuxt applications using the nuxt-og-image or nuxt-seo packages (versions < 6.2.5) via passive scanning tools (e.g., Shodan, Censys) or by probing for the /_og/d/ or /og-image/ endpoints.
2. Confirm vulnerability: Send a baseline request such as GET /_og/d/og.png?width=100&height=100 to confirm the endpoint is active and returns an image response.
3. Craft malicious request: Construct an HTTP GET request with excessively large dimension parameters:

   GET /_og/d/og.png?width=20000&height=20000 HTTP/1.1
   Host: <target-host>

4. Trigger resource exhaustion: Send the crafted request (or multiple concurrent requests) to the target server. The server will attempt to allocate memory proportional to the requested image dimensions, exhausting RAM and video memory.
5. Achieve DoS: The server becomes unresponsive or crashes, denying service to legitimate users. Repeated requests can sustain the denial-of-service condition (Security Advisory, GitHub Advisory).

• Network: Unusual or repeated HTTP GET requests to /_og/d/ or /og-image/ endpoints with abnormally large width and/or height query parameter values (e.g., values exceeding 4000–5000 pixels); high request rates to these endpoints from a single or small set of IP addresses.
• Logs: Web server or application access logs showing requests like GET /_og/d/og.png?width=20000&height=20000; HTTP 500 or timeout responses correlated with these requests; Node.js process logs indicating out-of-memory (OOM) errors or crashes.
• Process/System: Sudden spikes in server memory consumption coinciding with requests to the image-generation endpoint; video memory exhaustion errors in system or application logs; Node.js process restarts or crashes without other apparent cause (Security Advisory).

Upgrade the nuxt-og-image npm package to version 6.2.5 or later, which introduces server-side restrictions on the width and height parameters (GitHub Advisory, Security Advisory). As interim workarounds prior to patching, operators should implement rate limiting on the /_og/d/ and /og-image/ endpoints at the reverse proxy or WAF layer, and configure request filtering rules to reject requests with width or height values exceeding reasonable bounds (e.g., 2000 pixels). Applications using nuxt-seo should also verify the bundled nuxt-og-image version is updated.

The vulnerability was discovered and responsibly disclosed by Dmitry Prokhorov of Positive Technologies, who conducted a security analysis of the nuxt-og-image package as part of broader research into the nuxt-seo ecosystem (Security Advisory). The advisory was published by maintainer harlan-zw on March 28, 2026, and the fix was released promptly in version 6.2.5. No significant broader media coverage or notable social media discussion has been identified beyond the standard advisory publication.