v1.11.1 is a security release.
🚨 Security release
This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.
@nuxt/image now requires ipx ^2.1.2, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.
Input formats are unchanged on this release line; the mitigation is the ipx upgrade itself.
👉 Changelog
🩹 Fixes
- ipx: require patched ipx for /_ipx route (GHSA-p5vf-pjf5-ggj3) (
f105285) - build: run nuxt-module-build prepare in prepack (
110bbe3)
🤖 CI
- automate 1.x releases with uppt (
bb9669a)
❤️ Contributors
- Daniel Roe (@danielroe)