CVE-2022-23646
Description
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.
How to fix
- vercel next.js12.1.0 or later
- next12.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vercel next.js | 10.0.0 ≤ v < 12.1.0 | 12.1.0 |
| nextnpm | 10.0.0 ≤ v < 12.1.0 | 12.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.