Packages / next / Security

HighVulnerabilityGHSA-9gr3-7897-pp7mCVE-2021-39178Published 1 Sep 2021

XSS in Image Optimization API for Next.js

Affected releases · next

  • 11.x11.0.0 – 11.1.0Fixed in 11.1.1
  • 10.x10.0.0 – 10.2.3No fix on this line yet

On 11.x, the newest line:

npm install next@11.1.1
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

11.x

  1. Affected

    11.0.0 – 11.1.0

    3 releases

  2. Fixed

    11.1.1 – 11.1.4

    4 releases

10.x

  1. Affected

    10.0.0 – 10.2.3

    18 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

  • Affected: All of the following must be true to be affected

    • Next.js between version 10.0.0 and 11.1.0

    • The next.config.js file has images.domains array assigned

    • The image host assigned in images.domains allows user-provided SVG

  • Not affected: The next.config.js file has images.loader assigned to something other than default

  • Not affected: Deployments on Vercel are not affected

Patches

Next.js v11.1.1