CVE-2022-23646: Improper CSP in Image Optimization API for Next.js
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this Next.js vulnerability?
The vulnerability ID of this Next.js vulnerability is CVE-2022-23646.
What is the severity level of CVE-2022-23646?
The severity level of CVE-2022-23646 is high with a CVSS score of 7.5.
How does the vulnerability impact Next.js?
The vulnerability impacts Next.js by allowing User Interface (UI) Misrepresentation of Critical Information.
Which version of Next.js is affected by this vulnerability?
Versions 10.0.0 to 12.0.9 of Next.js are affected by this vulnerability.
What is the fix for CVE-2022-23646 in Next.js?
To fix CVE-2022-23646 in Next.js, upgrade to version 12.1.0 or later.