v2.2.1 is a security release.
🚨 Security
This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.
@nuxt/image now requires ipx ^4.1.0, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.
Behaviour change: /_ipx now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds 403 to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new image.ipx.allowedInputFormats option. For sources you do not fully trust, also consider image.ipx.restrictDecoders, which blocks the decoders of every other format for the whole process.
👉 Changelog
🩹 Fixes
- ipx: require patched ipx and restrict input formats for /_ipx route (GHSA-p5vf-pjf5-ggj3) (
750a4f0) - ipx: use IPXFetchHandler so
srvx/nodeis not required at runtime (#2336) - ipx: import
NitroRuntimeConfigfromnitropack/types(#2354)
🎉 New Contributors
- Chairul Akmal (@chairulakmal)
❤️ Contributors
- Daniel Roe (@danielroe)
- Chairul Akmal (@chairulakmal)
- Luke Nelson (@luc122c)