CVE-2021-39178: XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-31 · updated 2026-06-17
Weakness: CWE-79

Description

Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.

Affected products

Next.js: from 10.0.0 before 11.1.1 — fixed in 11.1.1

How to fix

Upgrade to a fixed version: Next.js 11.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-39178 or the next vulnerability affects your stack