CVE-2026-102527 nuxt-modules CVE debrief

Who should care

Defenders responsible for Nuxt OG Image deployments, particularly those using version 6.2.5, should assess exposure and prioritize mitigation to prevent cache poisoning attacks. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the integrity of image content delivered to users.

Why it matters

CVE-2026-102527 allows unauthenticated attackers to modify image content in Nuxt OG Image version 6.2.5 due to derivable cache keys. Defenders should upgrade to version 6.7.2 and configure a secure secret to prevent such attacks.

• Content spoofing attacks through cache poisoning
• Potential for unauthorized image content modification
• Need for verification of image integrity
• Upgrade and configuration changes required for mitigation

Technical summary

The vulnerability in Nuxt OG Image version 6.2.5 arises from the generation of cache keys in the Open Graph image cache. An unauthenticated attacker can exploit this by modifying image content delivered to users. The issue is resolved in version 6.7.2, where a secure `secret` in the `ogImage` configuration prevents such attacks. This vulnerability allows for content spoofing attacks through cache poisoning and potential for unauthorized image content modification. Defenders should prioritize upgrading to version 6.7.2 and configuring a secure secret for ogImage to prevent cache poisoning attacks.

Defensive priority

Defenders should prioritize upgrading to version 6.7.2 and configuring a secure secret for ogImage to prevent cache poisoning attacks.

Recommended defensive actions

• Upgrade to version 6.7.2 of Nuxt OG Image
• Configure a sufficiently secure `secret` in the `ogImage` configuration
• Review and update affected deployments to ensure secure image generation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was discovered by Dmitry Vanin of Positive Technologies. The issue arises from the generation of cache keys in the Open Graph image cache, which can be exploited by an unauthenticated attacker to modify image content.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.