High severity7.5NVD Advisory· Published Aug 31, 2021· Updated Jun 17, 2026
CVE-2021-39178
CVE-2021-39178
Description
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the next.config.js file must have images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nextnpm | >= 10.0.0, < 11.1.1 | 11.1.1 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/vercel/next.js/releases/tag/v11.1.1nvdPatchRelease NotesThird Party AdvisoryWEB
- github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7mnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-9gr3-7897-pp7mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-39178ghsaADVISORY
- github.com/vercel/next.js/commit/7afc97c5744b38bdf36aa7f87625f438224688aaghsaWEB
- github.com/vercel/next.js/pull/28620ghsaWEB
News mentions
0No linked articles in our index yet.