nuxt-og-image 6.6.0 → 6.7.0

package/README.md

@@ -47,6 +47,8 @@ npx nuxi@latest module add og-image
 > npx skilld add nuxt-og-image
 > ```
 
+💡 Built your OG images? Check how they render across Twitter, Facebook, LinkedIn and Slack with the free [Social Share Debugger](https://nuxtseo.com/tools/social-share-debugger), or monitor them site-wide with [Nuxt SEO Pro](https://nuxtseo.com/pro).
+
 ## Documentation
 
 [📖 Read the full documentation](https://nuxtseo.com/og-image/getting-started/installation) for more information.

package/dist/chunks/tw4.cjs

@@ -4,7 +4,8 @@ const promises = require('node:fs/promises');
 const node_url = require('node:url');
 const exsolve = require('exsolve');
 const pathe = require('pathe');
-const module$1 = require('../shared/nuxt-og-image.CfTPCtaS.cjs');
+const module$1 = require('../shared/nuxt-og-image.yDJBWXBt.cjs');
+require('node:crypto');
 require('node:fs');
 require('@nuxt/kit');
 require('defu');
@@ -12,12 +13,14 @@ require('nuxt-site-config/kit');
 require('ohash');
 require('pkg-types');
 require('std-env');
-require('node:crypto');
 require('oxc-walker');
-require('nuxtseo-shared/kit');
+require('../shared/nuxt-og-image.RI9DgjgV.cjs');
+require('magicast');
+require('magicast/helpers');
 require('../../dist/runtime/logger.js');
-require('chrome-launcher');
 require('nypm');
+require('nuxtseo-shared/kit');
+require('chrome-launcher');
 require('nuxtseo-shared/devtools');
 require('unstorage');
 require('unstorage/drivers/fs-lite');
@@ -30,9 +33,6 @@ require('@vue/compiler-sfc');
 require('ofetch');
 require('ultrahtml');
 require('../../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js');
-require('../shared/nuxt-og-image.CMYbz66P.cjs');
-require('magicast');
-require('magicast/helpers');
 
 const RE_GRADIENT_STOP_PREFIX = /^(from|via|to)-/;
 const RE_COLOR_SHADE = /^(.+)-(\d+)$/;

package/dist/chunks/tw4.mjs

@@ -2,7 +2,8 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { resolveModulePath } from 'exsolve';
 import { dirname, join } from 'pathe';
-import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, i as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, l as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.DdbTs-xp.mjs';
+import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, i as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, l as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.CPSxZhVO.mjs';
+import 'node:crypto';
 import 'node:fs';
 import '@nuxt/kit';
 import 'defu';
@@ -10,12 +11,14 @@ import 'nuxt-site-config/kit';
 import 'ohash';
 import 'pkg-types';
 import 'std-env';
-import 'node:crypto';
 import 'oxc-walker';
-import 'nuxtseo-shared/kit';
+import '../shared/nuxt-og-image.DM30kcDz.mjs';
+import 'magicast';
+import 'magicast/helpers';
 import '../../dist/runtime/logger.js';
-import 'chrome-launcher';
 import 'nypm';
+import 'nuxtseo-shared/kit';
+import 'chrome-launcher';
 import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
@@ -28,9 +31,6 @@ import '@vue/compiler-sfc';
 import 'ofetch';
 import 'ultrahtml';
 import '../../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js';
-import '../shared/nuxt-og-image.CJa2KCie.mjs';
-import 'magicast';
-import 'magicast/helpers';
 
 const RE_GRADIENT_STOP_PREFIX = /^(from|via|to)-/;
 const RE_COLOR_SHADE = /^(.+)-(\d+)$/;

package/dist/chunks/uno.cjs

@@ -3,7 +3,8 @@
 const promises = require('node:fs/promises');
 const defu = require('defu');
 const logger_js = require('../../dist/runtime/logger.js');
-const module$1 = require('../shared/nuxt-og-image.CfTPCtaS.cjs');
+const module$1 = require('../shared/nuxt-og-image.yDJBWXBt.cjs');
+require('node:crypto');
 require('node:fs');
 require('node:url');
 require('@nuxt/kit');
@@ -12,11 +13,13 @@ require('ohash');
 require('pathe');
 require('pkg-types');
 require('std-env');
-require('node:crypto');
 require('oxc-walker');
+require('../shared/nuxt-og-image.RI9DgjgV.cjs');
+require('magicast');
+require('magicast/helpers');
+require('nypm');
 require('nuxtseo-shared/kit');
 require('chrome-launcher');
-require('nypm');
 require('nuxtseo-shared/devtools');
 require('unstorage');
 require('unstorage/drivers/fs-lite');
@@ -30,9 +33,6 @@ require('ofetch');
 require('ultrahtml');
 require('../../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js');
 require('exsolve');
-require('../shared/nuxt-og-image.CMYbz66P.cjs');
-require('magicast');
-require('magicast/helpers');
 
 const RE_SVG_DATA_URL = /url\("data:image\/svg\+xml[;,]([^"]+)"\)/;
 const RE_UTF8_PREFIX = /^utf8,/;

package/dist/chunks/uno.mjs

@@ -1,7 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { defu } from 'defu';
 import { logger } from '../../dist/runtime/logger.js';
-import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.DdbTs-xp.mjs';
+import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.CPSxZhVO.mjs';
+import 'node:crypto';
 import 'node:fs';
 import 'node:url';
 import '@nuxt/kit';
@@ -10,11 +11,13 @@ import 'ohash';
 import 'pathe';
 import 'pkg-types';
 import 'std-env';
-import 'node:crypto';
 import 'oxc-walker';
+import '../shared/nuxt-og-image.DM30kcDz.mjs';
+import 'magicast';
+import 'magicast/helpers';
+import 'nypm';
 import 'nuxtseo-shared/kit';
 import 'chrome-launcher';
-import 'nypm';
 import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
@@ -28,9 +31,6 @@ import 'ofetch';
 import 'ultrahtml';
 import '../../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js';
 import 'exsolve';
-import '../shared/nuxt-og-image.CJa2KCie.mjs';
-import 'magicast';
-import 'magicast/helpers';
 
 const RE_SVG_DATA_URL = /url\("data:image\/svg\+xml[;,]([^"]+)"\)/;
 const RE_UTF8_PREFIX = /^utf8,/;

package/dist/cli.cjs

@@ -10,10 +10,14 @@ const nypm = require('nypm');
 const oxcWalker = require('oxc-walker');
 const pathe = require('pathe');
 const ultrahtml = require('ultrahtml');
-const fonts = require('./shared/nuxt-og-image.CMYbz66P.cjs');
+const dependencies = require('./shared/nuxt-og-image.RI9DgjgV.cjs');
 require('magicast');
 require('magicast/helpers');
 require('../dist/runtime/logger.js');
+require('std-env');
+require('defu');
+require('nuxtseo-shared/kit');
+require('chrome-launcher');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopNamespaceCompat(e) {
@@ -189,11 +193,14 @@ const RENDERERS = [
   }
 ];
 const EDGE_PRESETS = ["cloudflare", "cloudflare-pages", "cloudflare-module", "vercel-edge", "netlify-edge"];
-function getRendererDeps(renderer, isEdge) {
+function getRendererDeps(renderer, isEdge, options = {}) {
   switch (renderer) {
     case "satori":
       return isEdge ? ["satori", "@resvg/resvg-js", "@resvg/resvg-wasm"] : ["satori", "@resvg/resvg-js"];
     case "takumi":
+      if (options.installSpec) {
+        return isEdge ? [dependencies.TAKUMI_CORE_INSTALL_SPEC, dependencies.TAKUMI_WASM_INSTALL_SPEC] : [dependencies.TAKUMI_CORE_INSTALL_SPEC];
+      }
       return isEdge ? ["@takumi-rs/core", "@takumi-rs/wasm"] : ["@takumi-rs/core"];
     case "browser":
       return isEdge ? [] : ["playwright-core"];
@@ -554,7 +561,7 @@ async function installRendererDeps(renderers, isEdge) {
   const pmName = pm?.name || "npm";
   const allDeps = [];
   for (const renderer of renderers) {
-    allDeps.push(...getRendererDeps(renderer, isEdge));
+    allDeps.push(...getRendererDeps(renderer, isEdge, { installSpec: true }));
   }
   const uniqueDeps = [...new Set(allDeps)];
   if (uniqueDeps.length === 0)
@@ -706,7 +713,7 @@ async function runMigrate(args2) {
     if (dryRun) {
       p__namespace.log.info(`Would remove defaults.component: '${migrationCheck.defaultComponentName}'`);
     } else {
-      const result = await fonts.migrateDefaultsComponent(cwd).catch((err) => {
+      const result = await dependencies.migrateDefaultsComponent(cwd).catch((err) => {
         p__namespace.log.warn(`Failed to migrate defaults.component: ${err.message}`);
         return { migrated: false, componentName: null, message: err.message };
       });
@@ -720,7 +727,7 @@ async function runMigrate(args2) {
     if (dryRun) {
       p__namespace.log.info("Would migrate ogImage.fonts to @nuxt/fonts config");
     } else {
-      const result = await fonts.migrateFontsConfig(cwd).catch((err) => {
+      const result = await dependencies.migrateFontsConfig(cwd).catch((err) => {
         p__namespace.log.warn(`Failed to migrate fonts config: ${err.message}`);
         return { migrated: false, message: err.message };
       });

package/dist/cli.mjs

@@ -8,10 +8,14 @@ import { detectPackageManager, removeDependency, addDependency } from 'nypm';
 import { parseAndWalk } from 'oxc-walker';
 import { dirname, resolve, join, relative, basename } from 'pathe';
 import { parse, walkSync, ELEMENT_NODE } from 'ultrahtml';
-import { m as migrateDefaultsComponent, a as migrateFontsConfig } from './shared/nuxt-og-image.CJa2KCie.mjs';
+import { m as migrateDefaultsComponent, a as migrateFontsConfig, T as TAKUMI_CORE_INSTALL_SPEC, b as TAKUMI_WASM_INSTALL_SPEC } from './shared/nuxt-og-image.DM30kcDz.mjs';
 import 'magicast';
 import 'magicast/helpers';
 import '../dist/runtime/logger.js';
+import 'std-env';
+import 'defu';
+import 'nuxtseo-shared/kit';
+import 'chrome-launcher';
 
 const __dirname$1 = dirname(fileURLToPath(import.meta.url));
 const communityDir = resolve(__dirname$1, "runtime/app/components/Templates/Community");
@@ -172,11 +176,14 @@ const RENDERERS = [
   }
 ];
 const EDGE_PRESETS = ["cloudflare", "cloudflare-pages", "cloudflare-module", "vercel-edge", "netlify-edge"];
-function getRendererDeps(renderer, isEdge) {
+function getRendererDeps(renderer, isEdge, options = {}) {
   switch (renderer) {
     case "satori":
       return isEdge ? ["satori", "@resvg/resvg-js", "@resvg/resvg-wasm"] : ["satori", "@resvg/resvg-js"];
     case "takumi":
+      if (options.installSpec) {
+        return isEdge ? [TAKUMI_CORE_INSTALL_SPEC, TAKUMI_WASM_INSTALL_SPEC] : [TAKUMI_CORE_INSTALL_SPEC];
+      }
       return isEdge ? ["@takumi-rs/core", "@takumi-rs/wasm"] : ["@takumi-rs/core"];
     case "browser":
       return isEdge ? [] : ["playwright-core"];
@@ -537,7 +544,7 @@ async function installRendererDeps(renderers, isEdge) {
   const pmName = pm?.name || "npm";
   const allDeps = [];
   for (const renderer of renderers) {
-    allDeps.push(...getRendererDeps(renderer, isEdge));
+    allDeps.push(...getRendererDeps(renderer, isEdge, { installSpec: true }));
   }
   const uniqueDeps = [...new Set(allDeps)];
   if (uniqueDeps.length === 0)

package/dist/module.cjs

@@ -1,5 +1,6 @@
 'use strict';
 
+require('node:crypto');
 require('node:fs');
 require('node:fs/promises');
 require('node:url');
@@ -10,13 +11,11 @@ require('ohash');
 require('pathe');
 require('pkg-types');
 require('std-env');
-const module$1 = require('./shared/nuxt-og-image.CfTPCtaS.cjs');
+const module$1 = require('./shared/nuxt-og-image.yDJBWXBt.cjs');
+require('./shared/nuxt-og-image.RI9DgjgV.cjs');
 require('nuxtseo-shared/kit');
 require('../dist/runtime/logger.js');
-require('node:crypto');
 require('oxc-walker');
-require('chrome-launcher');
-require('nypm');
 require('nuxtseo-shared/devtools');
 require('unstorage');
 require('unstorage/drivers/fs-lite');
@@ -30,9 +29,10 @@ require('ofetch');
 require('ultrahtml');
 require('../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js');
 require('exsolve');
-require('./shared/nuxt-og-image.CMYbz66P.cjs');
 require('magicast');
 require('magicast/helpers');
+require('nypm');
+require('chrome-launcher');
 
 
 

package/dist/module.d.cts

@@ -186,12 +186,14 @@ interface ModuleOptions {
          * keyed hash signature and the handler rejects requests with missing or
          * invalid signatures.
          *
-         * Must be a stable string across deployments. Generate one with:
+         * Leave unset to auto-generate a per-build secret (signing on by default).
+         * Set an explicit, stable string for rolling or multi-instance deploys, or
+         * `false` to disable signing entirely. Generate one with:
          * `npx nuxt-og-image generate-secret`
          *
-         * Required when `strict` is enabled.
+         * Required (explicitly) when `strict` is enabled.
          */
-        secret?: string;
+        secret?: string | false;
         /**
          * Enable strict security mode. When enabled:
          * - `secret` is required (URL signing)

package/dist/module.d.mts

@@ -186,12 +186,14 @@ interface ModuleOptions {
          * keyed hash signature and the handler rejects requests with missing or
          * invalid signatures.
          *
-         * Must be a stable string across deployments. Generate one with:
+         * Leave unset to auto-generate a per-build secret (signing on by default).
+         * Set an explicit, stable string for rolling or multi-instance deploys, or
+         * `false` to disable signing entirely. Generate one with:
          * `npx nuxt-og-image generate-secret`
          *
-         * Required when `strict` is enabled.
+         * Required (explicitly) when `strict` is enabled.
          */
-        secret?: string;
+        secret?: string | false;
         /**
          * Enable strict security mode. When enabled:
          * - `secret` is required (URL signing)

package/dist/module.d.ts

@@ -186,12 +186,14 @@ interface ModuleOptions {
          * keyed hash signature and the handler rejects requests with missing or
          * invalid signatures.
          *
-         * Must be a stable string across deployments. Generate one with:
+         * Leave unset to auto-generate a per-build secret (signing on by default).
+         * Set an explicit, stable string for rolling or multi-instance deploys, or
+         * `false` to disable signing entirely. Generate one with:
          * `npx nuxt-og-image generate-secret`
          *
-         * Required when `strict` is enabled.
+         * Required (explicitly) when `strict` is enabled.
          */
-        secret?: string;
+        secret?: string | false;
         /**
          * Enable strict security mode. When enabled:
          * - `secret` is required (URL signing)

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": ">=3.16.0"
   },
   "configKey": "ogImage",
-  "version": "6.6.0",
+  "version": "6.7.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,3 +1,4 @@
+import 'node:crypto';
 import 'node:fs';
 import 'node:fs/promises';
 import 'node:url';
@@ -8,13 +9,11 @@ import 'ohash';
 import 'pathe';
 import 'pkg-types';
 import 'std-env';
-export { m as default } from './shared/nuxt-og-image.DdbTs-xp.mjs';
+export { m as default } from './shared/nuxt-og-image.CPSxZhVO.mjs';
+import './shared/nuxt-og-image.DM30kcDz.mjs';
 import 'nuxtseo-shared/kit';
 import '../dist/runtime/logger.js';
-import 'node:crypto';
 import 'oxc-walker';
-import 'chrome-launcher';
-import 'nypm';
 import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
@@ -28,6 +27,7 @@ import 'ofetch';
 import 'ultrahtml';
 import '../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js';
 import 'exsolve';
-import './shared/nuxt-og-image.CJa2KCie.mjs';
 import 'magicast';
 import 'magicast/helpers';
+import 'nypm';
+import 'chrome-launcher';

package/dist/runtime/server/og-image/bindings/font-assets/cloudflare.d.ts

@@ -1,3 +1,3 @@
 import type { H3Event } from 'h3';
 import type { FontConfig } from '../../../../types.js';
-export declare function resolve(event: H3Event, font: FontConfig): Promise<Buffer<ArrayBuffer>>;
+export declare function resolve(event: H3Event, font: FontConfig): Promise<Buffer<ArrayBufferLike>>;

package/dist/runtime/server/og-image/bindings/font-assets/cloudflare.js

@@ -1,14 +1,19 @@
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withBase } from "ufo";
+import { getSiteConfig } from "#site-config/server/composables";
 import { getCloudflareAssets } from "../../../util/cloudflareAssets.js";
 import { fetchLocalAsset } from "../../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
+import { fetchSpecialFontUrl, isDataFontUrl, isExternalFontUrl } from "./external-url.js";
 export async function resolve(event, font) {
   const path = font.src || font.localPath;
+  const runtimeConfig = useOgImageRuntimeConfig();
+  const timeout = getFetchTimeout(runtimeConfig);
   const { app } = useRuntimeConfig();
   const fullPath = withBase(path, app.baseURL);
-  const timeout = getFetchTimeout(useOgImageRuntimeConfig());
+  if (path && (isDataFontUrl(path) || isExternalFontUrl(path)))
+    return fetchSpecialFontUrl(path, getSiteConfig(event).url, timeout);
   const ab = await fetchLocalAsset(event, fullPath, { fetchTimeout: timeout });
   if (ab)
     return Buffer.from(ab);

package/dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js

@@ -4,8 +4,11 @@ import { useRuntimeConfig } from "nitropack/runtime";
 import { join } from "pathe";
 import { withBase } from "ufo";
 import { buildDir, rootDir } from "#og-image-virtual/build-dir.mjs";
+import { getSiteConfig } from "#site-config/server/composables";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
+import { fetchWithRedirectValidation } from "../../../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
+import { fetchSpecialFontUrl, isDataFontUrl, isExternalFontUrl } from "./external-url.js";
 let fontUrlMapping;
 async function loadFontUrlMapping() {
   if (fontUrlMapping)
@@ -16,12 +19,15 @@ async function loadFontUrlMapping() {
 }
 export async function resolve(event, font) {
   const path = font.src || font.localPath;
-  const timeout = getFetchTimeout(useOgImageRuntimeConfig());
+  const runtimeConfig = useOgImageRuntimeConfig();
+  const timeout = getFetchTimeout(runtimeConfig);
   if (font.absolutePath) {
     const data = await readFile(font.absolutePath).catch(() => null);
     if (data?.length)
       return data;
   }
+  if (path && (isDataFontUrl(path) || isExternalFontUrl(path)))
+    return fetchSpecialFontUrl(path, getSiteConfig(event).url, timeout);
   if (import.meta.prerender) {
     if (path.startsWith("/_og-static-fonts/")) {
       const filename2 = path.slice("/_og-static-fonts/".length);
@@ -72,14 +78,15 @@ export async function resolve(event, font) {
   if (import.meta.dev) {
     const reqUrl = getRequestURL(event);
     const origin = `${reqUrl.protocol}//${reqUrl.host}`;
-    const url = new URL(withBase(path, app.baseURL), origin).href;
-    const res = await fetch(url, { signal: AbortSignal.timeout(timeout) }).catch(() => null);
-    if (res?.ok) {
-      return Buffer.from(await res.arrayBuffer());
+    const target = new URL(withBase(path, app.baseURL), origin);
+    const ab = await fetchWithRedirectValidation(target.href, { timeout, trustedHost: target.host }).catch(() => null);
+    if (ab) {
+      return Buffer.from(ab);
     }
   }
   const fullPath = withBase(path, app.baseURL);
-  const arrayBuffer = await event.$fetch(fullPath, {
+  const fetchArrayBuffer = event.$fetch;
+  const arrayBuffer = await fetchArrayBuffer(fullPath, {
     responseType: "arrayBuffer",
     timeout
   });

package/dist/runtime/server/og-image/bindings/font-assets/external-url.d.ts

@@ -0,0 +1,36 @@
+/** True for an inline `data:` font URI (no network — safe to decode directly). */
+export declare function isDataFontUrl(path: string): boolean;
+/**
+ * True when a font path carries its own authority (`//host`, `http://host`,
+ * `\\host`) or a non-http scheme — i.e. it would not resolve same-origin.
+ *
+ * Classification resolves the path against a sentinel origin through the WHATWG
+ * URL parser, so it sees exactly what `fetch` will: leading C0 controls/spaces,
+ * embedded tab/CR/LF, and backslash folding are all normalized first. This
+ * closes the bypass class where " //127.0.0.1" or " //169.254.169.254" looks
+ * relative to a naive scheme check yet resolves cross-origin (GHSA-q8hw-4fvp-9rwv).
+ * Check `isDataFontUrl` first — `data:` is non-http and would report true here.
+ */
+export declare function isExternalFontUrl(path: string): boolean;
+/**
+ * Resolve an authority-bearing font URL to the href to fetch, but only when it
+ * is same-origin with the configured site URL. Returns null otherwise.
+ *
+ * Runtime external font URLs are unsupported — `@nuxt/fonts` is the only
+ * supported way to load custom fonts, and it serves them same-origin. The single
+ * allowed exception is the site's own origin, gated on an explicitly configured
+ * site URL. Resolving against that origin also collapses canonicalization
+ * bypasses (a crafted " //127.0.0.1" resolves cross-origin → rejected).
+ */
+export declare function resolveSameOriginFontUrl(path: string, siteUrl: string | undefined): string | null;
+/**
+ * Fetch a `data:` or authority-bearing font URL. `data:` is decoded directly
+ * (no network). An external URL is fetched only when same-origin with the site
+ * URL, and always through the SSRF guard (scheme allowlist, private-network
+ * block, per-hop redirect re-validation) so the site's own host can't be used
+ * to relay into its internal network via an open redirect.
+ *
+ * Throws on an unsupported/blocked/unreachable URL so the caller falls back to a
+ * bundled font; blocked targets stay indistinguishable from missing fonts.
+ */
+export declare function fetchSpecialFontUrl(path: string, siteUrl: string | undefined, timeout: number): Promise<Buffer>;

package/dist/runtime/server/og-image/bindings/font-assets/external-url.js

@@ -0,0 +1,47 @@
+import { fetchWithRedirectValidation } from "../../../util/ssrf.js";
+const SENTINEL_ORIGIN = "http://font-asset.invalid/";
+const SENTINEL_HOST = "font-asset.invalid";
+export function isDataFontUrl(path) {
+  return path.trimStart().toLowerCase().startsWith("data:");
+}
+export function isExternalFontUrl(path) {
+  let resolved;
+  try {
+    resolved = new URL(path, SENTINEL_ORIGIN);
+  } catch {
+    return true;
+  }
+  return resolved.protocol !== "http:" || resolved.host !== SENTINEL_HOST;
+}
+export function resolveSameOriginFontUrl(path, siteUrl) {
+  if (!siteUrl)
+    return null;
+  let siteOrigin;
+  try {
+    siteOrigin = new URL(siteUrl).origin;
+  } catch {
+    return null;
+  }
+  let target;
+  try {
+    target = new URL(path, siteOrigin);
+  } catch {
+    return null;
+  }
+  return target.origin === siteOrigin ? target.href : null;
+}
+export async function fetchSpecialFontUrl(path, siteUrl, timeout) {
+  if (isDataFontUrl(path)) {
+    const res = await fetch(path.trimStart(), { signal: AbortSignal.timeout(timeout) }).catch(() => null);
+    if (res?.ok)
+      return Buffer.from(await res.arrayBuffer());
+    throw new Error("[Nuxt OG Image] Invalid data: font URL.");
+  }
+  const href = resolveSameOriginFontUrl(path, siteUrl);
+  if (!href)
+    throw new Error("[Nuxt OG Image] External font URLs are not supported. Load custom fonts via @nuxt/fonts.");
+  const ab = await fetchWithRedirectValidation(href, { timeout });
+  if (!ab)
+    throw new Error("[Nuxt OG Image] Font URL blocked or unreachable.");
+  return Buffer.from(ab);
+}

package/dist/runtime/server/og-image/bindings/font-assets/node.d.ts

@@ -1,3 +1,3 @@
 import type { H3Event } from 'h3';
 import type { FontConfig } from '../../../../types.js';
-export declare function resolve(event: H3Event, font: FontConfig): Promise<Buffer<ArrayBuffer>>;
+export declare function resolve(event: H3Event, font: FontConfig): Promise<Buffer<ArrayBufferLike>>;

package/dist/runtime/server/og-image/bindings/font-assets/node.js

@@ -1,19 +1,26 @@
 import { useRuntimeConfig } from "nitropack/runtime";
 import { withBase } from "ufo";
-import { getNitroOrigin } from "#site-config/server/composables";
+import { getNitroOrigin, getSiteConfig } from "#site-config/server/composables";
 import { getFetchTimeout } from "../../../util/fetchTimeout.js";
+import { fetchWithRedirectValidation } from "../../../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../../../utils.js";
+import { fetchSpecialFontUrl, isDataFontUrl, isExternalFontUrl } from "./external-url.js";
 export async function resolve(event, font) {
   const path = font.src || font.localPath;
+  const runtimeConfig = useOgImageRuntimeConfig();
+  const timeout = getFetchTimeout(runtimeConfig);
   const { app } = useRuntimeConfig();
-  const fullPath = withBase(path, app.baseURL);
   const origin = getNitroOrigin(event);
-  const timeout = getFetchTimeout(useOgImageRuntimeConfig());
-  const res = await fetch(new URL(fullPath, origin).href, { signal: AbortSignal.timeout(timeout) }).catch(() => null);
-  if (res?.ok) {
-    return Buffer.from(await res.arrayBuffer());
+  const fullPath = withBase(path, app.baseURL);
+  if (path && (isDataFontUrl(path) || isExternalFontUrl(path)))
+    return fetchSpecialFontUrl(path, getSiteConfig(event).url, timeout);
+  const target = new URL(fullPath, origin);
+  const ab = await fetchWithRedirectValidation(target.href, { timeout, trustedHost: target.host }).catch(() => null);
+  if (ab) {
+    return Buffer.from(ab);
   }
-  const arrayBuffer = await event.$fetch(fullPath, {
+  const fetchArrayBuffer = event.$fetch;
+  const arrayBuffer = await fetchArrayBuffer(fullPath, {
     responseType: "arrayBuffer",
     timeout
   });

package/dist/runtime/server/og-image/bindings/takumi/node-dev.js

@@ -17,7 +17,10 @@ parentPort.on('message', async ({ id, type, newFonts, nodes, options }) => {
     const fontWarnings = []
     for (const font of (newFonts || [])) {
       try {
-        await renderer.loadFont({
+        const registerFont = renderer.registerFont || renderer.loadFont
+        if (typeof registerFont !== 'function')
+          throw new Error('renderer does not expose loadFont/registerFont')
+        await registerFont.call(renderer, {
           name: font.name,
           data: font.data,
           weight: font.weight,
@@ -127,6 +130,9 @@ class RendererWorkerProxy {
     this.allFonts.push(font);
     this.pendingFonts.push(font);
   }
+  registerFont(font) {
+    this.loadFont(font);
+  }
   render(nodes, options) {
     ensureWorker();
     let fontsToSend;

package/dist/runtime/server/og-image/fonts.d.ts

@@ -42,6 +42,10 @@ export declare function loadAllFonts(event: H3Event, options: LoadFontsOptions):
 /**
  * Load additional fonts specified via defineOgImage({ fonts: [...] }).
  * Only object format ({ name, weight, path }) with a path is supported.
+ *
+ * Field values arrive from the attacker-controlled `fonts` URL param, so each is
+ * parsed at this boundary (require string name/path, coerce weight) and the
+ * array is bounded before any font is fetched.
  */
 export declare function loadDefinedFonts(event: OgImageRenderEventContext, fontDefs: any[]): Promise<RuntimeFontConfig[]>;
 export interface LoadFontsForRendererOptions extends LoadFontsOptions {