CVE-2026-34405: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34405 is a reflected Cross-Site Scripting (XSS) vulnerability in the Nuxt OG Image package (nuxt-og-image) for Node.js, caused by incorrect parsing of GET parameters that allows injection of arbitrary attributes into the HTML page body. It affects all versions of nuxt-og-image prior to 6.2.5, exploitable via the /_og/d/ endpoint (and /og-image/ in older versions). The vulnerability was discovered by Dmitry Prokhorov of Positive Technologies, published on March 28, 2026, and patched in version 6.2.5. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified as reflected XSS. The image-generation component at /_og/d/ fails to sanitize or validate GET query parameters before inserting them into the generated HTML page; parameters such as onmouseover and autofocus are treated as HTML attributes and injected directly into the page body without escaping. An attacker can craft a malicious URL targeting this endpoint — for example, /_og/d/og.html?width=1000&height=1000&onmouseover=alert(document.cookie)&autofocus — and trick a victim into visiting it, triggering client-side JavaScript execution in the victim's browser. No authentication or special privileges are required; only user interaction (visiting the crafted link) is needed (Security Advisory, GitHub Advisory).

Successful exploitation enables client-side JavaScript execution in the context of the victim's browser session, with a changed scope affecting resources beyond the vulnerable component. Practical consequences include session hijacking via cookie theft, credential phishing through crafted OG image preview pages, and malicious redirects targeting users who interact with attacker-controlled links. Confidentiality and integrity are both partially impacted (low), while availability is unaffected (GitHub Advisory, Security Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of a specific crafted HTTP GET request with injected event handler attributes that achieves JavaScript execution on a vulnerable system. There is no current evidence of in-the-wild exploitation. The EPSS score is approximately 0.043% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Security Advisory).

1. Reconnaissance: Identify Nuxt-based web applications using the nuxt-og-image or nuxt-seo packages (versions < 6.2.5) by inspecting HTTP response headers, JavaScript bundles, or package manifests for references to nuxt-og-image.
2. Locate the vulnerable endpoint: Confirm the presence of the /_og/d/ endpoint (or /og-image/ on older versions) by sending a benign GET request such as GET /_og/d/og.html?width=1000&height=1000 HTTP/1.1.
3. Craft the malicious payload: Construct a URL with injected HTML event handler attributes as query parameters, e.g.:

   GET /_og/d/og.html?width=1000&height=1000&onmouseover=alert(document.cookie)&autofocus HTTP/1.1
   Host: target.example.com

4. Deliver the payload: Send the crafted URL to a victim via phishing email, social media, or any channel where the OG image preview would be rendered or the link clicked.
5. Achieve JavaScript execution: When the victim visits the URL, the injected attributes (onmouseover, autofocus, etc.) are rendered in the HTML page body, triggering the JavaScript payload in the victim's browser — enabling cookie theft, session hijacking, or further malicious actions (Security Advisory).

• Network: Unusual HTTP GET requests to /_og/d/ or /og-image/ endpoints containing unexpected query parameters beyond standard OG image parameters (e.g., onmouseover, autofocus, onclick, onfocus, or other HTML event handler names).
• Logs: Web server or application access logs showing requests to /_og/d/og.html with encoded or plaintext JavaScript payloads in query strings (e.g., alert(, document.cookie, fetch(, eval().
• Network: Outbound requests from victim browsers to attacker-controlled domains following interaction with crafted OG image URLs, potentially indicating successful cookie exfiltration.

The primary remediation is to upgrade nuxt-og-image to version 6.2.5 or later, which corrects the GET parameter parsing logic to prevent attribute injection (GitHub Advisory). As interim mitigations, implement a strict Content Security Policy (CSP) header to limit the impact of injected scripts, and validate/sanitize all user-supplied input processed by the /_og/d/ endpoint. Additionally, review web server access logs for suspicious requests to /_og/d/ and /og-image/ endpoints as a detection measure (Security Advisory).

The vulnerability was discovered and responsibly disclosed by Dmitry Prokhorov of Positive Technologies, a well-known security research firm, lending credibility to the finding. The advisory was published by the package maintainer (harlan-zw) on March 28, 2026, with a patch released promptly in version 6.2.5. No significant broader media coverage or notable community controversy has been identified beyond the standard advisory publication (Security Advisory).