CVE-2021-39178: XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the next.config.js file must have images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
next.jsto a version that resolves this vulnerability.Fixed in 11.1.1 - Configuration
For instances that are affected (next.config.js has images.domains set and the listed image host allows user-provided SVG), modify images.domains so that the image host(s) do not allow user-provided SVG.
Next.js (next.config.js) images.domains = must not allow user-provided SVG in domains listed in images.domains
Event History
Frequently Asked Questions
What is CVE-2021-39178?
CVE-2021-39178 is a cross-site scripting vulnerability in Next.js versions between 10.0.0 and 11.0.0.
How severe is CVE-2021-39178?
CVE-2021-39178 has a severity rating of 6.1, which is considered high.
How does CVE-2021-39178 impact Next.js?
CVE-2021-39178 can allow attackers to perform cross-site scripting attacks on instances of Next.js.
How can I fix CVE-2021-39178?
To fix CVE-2021-39178, you should upgrade Next.js to version 11.1.1 or higher, which includes a fix for the vulnerability.
Where can I find more information about CVE-2021-39178?
You can find more information about CVE-2021-39178 on the Next.js GitHub page and the associated security advisory.