Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2021-39178 - Vulnerability Database
Next.js

Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2021-39178

Medium
Reference: CVE-2021-39178
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-39178
Title: Next.js Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability
Overview:

Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability the next.config.js file must have images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default or the instance is deployed on Vercel the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.