CVE-2026-34404: Nuxt OG Image DoS Vulnerability

CVE-2026-34404 Overview

CVE-2026-34404 is a Denial of Service (DoS) vulnerability affecting the Nuxt OG Image module, which generates Open Graph images using Vue templates in the Nuxt framework. Prior to version 6.2.5, the image generation component accessible via the /_og/d/ URI (and /og-image/ in older versions) lacks proper restrictions on the width and height parameters for generated images. This allows attackers to exhaust server resources by requesting images with excessively large dimensions.

Critical Impact

Attackers can trigger resource exhaustion on Nuxt applications by requesting OG images with unrestricted dimensions, potentially causing service unavailability for legitimate users.

Affected Products

• Nuxt OG Image versions prior to 6.2.5
• Applications using /_og/d/ endpoint for OG image generation
• Applications using /og-image/ endpoint (older versions)

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34404 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34404

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The Nuxt OG Image module provides dynamic Open Graph image generation capabilities for Nuxt applications. The vulnerability exists because the image generation endpoints do not validate or restrict the width and height parameters supplied by users.

When an attacker crafts requests with extremely large dimension values, the server attempts to generate images at those sizes, consuming significant CPU, memory, and processing time. This can lead to resource exhaustion, degraded performance, or complete service unavailability for the affected application.

The vulnerability is reproducible using the standard configuration and default templates, meaning applications running the module out-of-the-box are susceptible without any special configuration required by the attacker.

Root Cause

The root cause is the absence of input validation on the width and height parameters passed to the image generation endpoints. Without maximum bounds checking, the server will attempt to allocate resources proportional to the requested dimensions, enabling attackers to force excessive resource consumption through maliciously crafted requests.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker simply needs to send HTTP requests to the vulnerable endpoints with arbitrarily large width and height values. No user interaction is required, and the attack can be executed using standard HTTP clients or scripting tools.

The vulnerable endpoints are:

• /_og/d/ (current versions)
• /og-image/ (older versions)

By repeatedly sending requests with large dimension parameters, an attacker can overwhelm the server's resources, causing denial of service conditions.

Detection Methods for CVE-2026-34404

Indicators of Compromise

• Unusual spikes in requests to /_og/d/ or /og-image/ endpoints
• Requests containing abnormally large width or height parameter values
• Server resource exhaustion symptoms including high CPU/memory utilization during image generation
• Application performance degradation or timeout errors

Detection Strategies

• Monitor web server access logs for high-volume requests to OG image generation endpoints
• Implement alerting on requests with width or height parameters exceeding reasonable thresholds (e.g., values above 4096 pixels)
• Track server resource utilization and correlate spikes with incoming requests to image generation endpoints
• Deploy rate limiting detection to identify potential DoS attack patterns

Monitoring Recommendations

• Configure application performance monitoring (APM) to track response times for OG image generation endpoints
• Set up alerts for memory and CPU utilization anomalies on servers hosting Nuxt applications
• Implement logging for all requests to /_og/d/ and /og-image/ endpoints with parameter values
• Review access logs regularly for patterns indicative of DoS attempts

How to Mitigate CVE-2026-34404

Immediate Actions Required

• Upgrade Nuxt OG Image module to version 6.2.5 or later immediately
• Implement rate limiting on the /_og/d/ and /og-image/ endpoints at the web server or reverse proxy level
• Consider temporarily disabling OG image generation endpoints if upgrading is not immediately possible
• Review and restrict access to image generation endpoints using network-level controls if needed

Patch Information

The vulnerability has been addressed in Nuxt OG Image version 6.2.5. Users should upgrade to this version or later to remediate the vulnerability. The security advisory is available on the GitHub Security Advisory page.

Workarounds

• Implement a reverse proxy rule to reject requests with excessively large dimension parameters
• Add rate limiting on OG image endpoints to prevent abuse from single sources
• Configure web application firewall (WAF) rules to block requests with suspicious parameter values
• Temporarily disable the OG image generation feature if it is not critical to application functionality

# Example nginx rate limiting configuration for OG image endpoints
limit_req_zone $binary_remote_addr zone=ogimage:10m rate=10r/s;

location /_og/d/ {
    limit_req zone=ogimage burst=20 nodelay;
    # Add maximum dimension validation at proxy level if possible
    proxy_pass http://upstream;
}