Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt-og-image | npm | >= 6.0.2, < 6.7.0 | 6.7.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the nuxt-og-image module, identified as CVE-2026-61793. The root cause is the lack of input validation on the fonts parameter provided in the URL path. An attacker can craft a URL containing a base64url-encoded JSON payload for the fonts parameter, specifying an arbitrary URL in the path field.
The analysis of the vulnerability description and the fixing commit 243cac2228671d3711c2bd65e300c278fcdf5a4e reveals the following vulnerable execution flow:
decodeOgImageParams function in dist/runtime/shared/urlEncoding.js blindly decodes and deserializes the fonts parameter from the URL, allowing an attacker to inject a malicious font configuration.loadDefinedFonts function in src/runtime/server/og-image/fonts.ts iterates over this attacker-controlled font configuration. In the vulnerable version, it performs insufficient validation before creating a fontConfig object.fontConfig object, containing the malicious URL path, is passed to a resolve function.resolve functions in both src/runtime/server/og-image/bindings/font-assets/node.ts (for production) and src/runtime/server/og-image/bindings/font-assets/dev-prerender.ts (for development) act as the final sinks. They take the unvalidated path and use it directly in a fetch() call, triggering the SSRF. This allows the server to make arbitrary GET requests to internal or external services.The patch addresses the vulnerability by adding robust validation at multiple layers: it introduces input sanitization and bounds checking in loadDefinedFonts and, most critically, replaces the direct fetch calls in the resolve functions with a new fetchWithRedirectValidation utility that checks for private/blocked IP addresses and handles redirects securely.
resolvesrc/runtime/server/og-image/bindings/font-assets/node.ts
resolvesrc/runtime/server/og-image/bindings/font-assets/dev-prerender.ts
loadDefinedFontssrc/runtime/server/og-image/fonts.ts
decodeOgImageParamsdist/runtime/shared/urlEncoding.js