Read the docs
TI-2021-16564 Aliases CVE-2021-39178GHSA-9gr3-7897-pp7m

XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

Priority LOW 35CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.

Why it matters now

EPSS 0.01139 66th percentileScored 2026-11-07
Fix Fixed next.js (vercel): 11.1.1next (npm): 11.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
vercelnext.js10.0.0 to before 11.1.111.1.1Patch availableCNA
—next (npm)10.0.0 to before 11.1.111.1.1Patch availableGHSA-9gr3-7897-pp7m
  • next.js Vendorvercel Affected 10.0.0 to before 11.1.1 Fixed in 11.1.1 Patch available CNA
  • next (npm) Vendor— Affected 10.0.0 to before 11.1.1 Fixed in 11.1.1 Patch available GHSA-9gr3-7897-pp7m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*10.0.0 to before 11.1.1Vulnerablevercel
  • cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 10.0.0 to before 11.1.1 Vulnerable ·vercel

Remediation

  • Fix · CNA next.js (vercel) Fixed in 11.1.1
  • Fix · GHSA-9gr3-7897-pp7m next (npm) Fixed in 11.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-39178
  2. 2026-10-03 Alias added: GHSA-9gr3-7897-pp7m

References

Patch 2

Advisory 1

Other 3

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
  • TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
  • TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
  • TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences