HighGHSA-9gr3-7897-pp7mCVE-2021-39178
XSS in Image Optimization API for Next.js
Published 1 Sept 2021 · Updated 8 Jul 2026
Affected package
nextnpm
- Affected
- >=10.0.0 <11.1.1
- Fixed in
- 11.1.1
Update to the fixed version for your release line, for example:
npm install next@11.1.1Details
Impact
- Affected: All of the following must be true to be affected
- Next.js between version 10.0.0 and 11.1.0
- The
next.config.jsfile has `images.domains` array assigned - The image host assigned in `images.domains` allows user-provided SVG
- Not affected: The
next.config.jsfile has `images.loader` assigned to something other than default - Not affected: Deployments on Vercel are not affected
Patches
Is GHSA-9gr3-7897-pp7m in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Linkgithub.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-39178
- Linkgithub.com/vercel/next.js/pull/28620
- Linkgithub.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aa
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/releases/tag/v11.1.1
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.