https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T04:28:33.228598+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-318641 EUVD-2026-318641 2026-10-05T04:28:33.276746+00:00 EUVD-2026-318641 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44589 fkie_cve-2026-44589 2026-10-05T04:28:33.276786+00:00

Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.

 https://cve.radiocsirt.org/vuln/ghsa-c2rm-g55x-8hr5 GHSA-c2rm-g55x-8hr5 — nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) 2026-10-05T04:28:33.276821+00:00

Affected: npm: nuxt-og-image

## Summary

The `isBlockedUrl()` denylist introduced in `nuxt-og-image@6.2.5` to remediate **GHSA-pqhr-mp3f-hrpp** (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. The patch advisory states "Decimal/hexadecimal IP encoding bypasses are also handled" — that part is true (Node's WHATWG URL parser canonicalizes those forms before validation), but the v6.2.5 implementation misses two independent surfaces in the latest release `6.4.8`:

1. **IPv6 prefix list is incomplete.** The IPv6 branch checks only `bare === "::1" || startsWith("fc") || startsWith("fd") || startsWith("fe80")`. It misses: - `[::ffff:7f00:1]` — IPv6-mapped IPv4 loopback in pure-hex form (RE_MAPPED_V4 regex requires dotted-quad). **Reaches 127.0.0.1 on a single-stack-IPv4 host with no other primitive needed.** - `[fec0::/10]` (RFC 3879 site-local — deprecated but still routable on legacy networks) - `[5f00::/16]` (RFC 9602 SRv6 SIDs) - `[3fff::/20]` (RFC 9637 IPv6 documentation v2) - `[64:ff9b:1::/48]` (RFC 8215 NAT64 local-use, including embedded IPv4 loopback `[64:ff9b:1::7f00:1]`)

2. **No redirect re-validation.** `isBlockedUrl` runs once on the initial `<img src>`. The subsequent `$fetch(decodedSrc, ...)` (ofetch, default redirect-follow) follows 30x responses with no second-pass validation. Any allowed origin that returns a 302 to an internal IP — S3 redirect rules, GCS, Azure, CloudFront, any user-content CDN where the attacker can place a single redirect — completes th…