# What changed in nuxt-og-image

> 10 changes in nuxt-og-image 6 to 7 from its official release notes, upgrade guides and advisories: 7 security. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/nuxt-og-image/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## nuxt-og-image 7

### Security

- Enforces WOFF allocation bounds when handling fonts. (7.0.5) — [release notes](https://github.com/nuxt-modules/og-image/releases/tag/v7.0.5)

### Fixes and other changes

- Asset checks are tightened. (7.0.7) — [release notes](https://github.com/nuxt-modules/og-image/releases/tag/v7.0.7)
- Route rules use Nuxt server primitives. (7.0.7) — [release notes](https://github.com/nuxt-modules/og-image/releases/tag/v7.0.7)
- Truncated font binaries are now rejected. (7.0.6) — [release notes](https://github.com/nuxt-modules/og-image/releases/tag/v7.0.6)

## nuxt-og-image 6

### Security

- Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes (6.7.0) — [security advisory](https://github.com/advisories/GHSA-2X6F-RP82-PPMJ)
- Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter (6.7.0) — [security advisory](https://github.com/advisories/GHSA-Q8HW-4FVP-9RWV)
- nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) (6.4.9) — [security advisory](https://github.com/advisories/GHSA-C2RM-G55X-8HR5)
- Nuxt OG Image is vulnerable to Denial of Service via unbounded image dimensions (6.2.5) — [security advisory](https://github.com/advisories/GHSA-C7XP-Q6Q8-HG76)
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes (6.2.5) — [security advisory](https://github.com/advisories/GHSA-MG36-WVCR-M75H)
- Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters (6.2.5) — [security advisory](https://github.com/advisories/GHSA-PQHR-MP3F-HRPP)