Executive brief
Next.js is a popular React-based web framework used to build production web applications. Versions 10.0.0 through 11.1.0 contain a reflected cross-site scripting (XSS) vulnerability in the Image Optimization API that allows attackers to inject malicious scripts when the application serves user-provided SVG images from configured domains. An attacker can craft a malicious URL to steal session cookies, hijack user accounts, or perform actions on behalf of compromised users.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in Next.js's Image Optimization API affecting versions 10.0.0–11.1.0. The root cause is improper neutralization of user-controlled input (specifically SVG image URLs) before rendering them in the web response. The attack requires: (1) the vulnerable Next.js version, (2) images.domains configured in next.config.js, and (3) the configured image host allowing user-provided SVG uploads or URLs. An unauthenticated attacker on the network can craft a malicious URL and trick a user into clicking it, causing arbitrary JavaScript to execute in the victim's browser. The fix is available in Next.js v11.1.1 and later. Deployments on Vercel's managed platform are not affected due to different image handling.
Affected products
- Vercel Next.js 10.0.0 through 11.1.0
Timeline
- 2021-08-31: disclosed
- 2021-09-01: patched: Next.js v11.1.1 released