Live › technique
Nuxt published GHSA-p5vf-pjf5-ggj3 (@nuxt/image) and GHSA-qf89-6xm4-66wm (ipx) on 2026-10-30, rated CVSS 8.1 with no CVE yet. ipx has an integer overflow when it decodes multi-page images (TIFF, GIF, WebP, AVIF). @nuxt/image registers the unauthenticated /_ipx route by default on server deployments. If an attacker can get their own image bytes in as an IPX source (an upload under a public path, a user-content host in image.domains, or arbitrary remote hosts allowed), a single request with no modifier needed reliably crashes the process. The memory corruption may also allow remote code execution with that process's privileges; in the reporter's reproduction it ran as root in a stock container. Affected versions: @nuxt/image 2.0.0 to <2.2.1, 1.0.0 to <1.11.2, and 0.6.x (end of life, no fix); ipx <2.1.2, 3.0.0 to <3.1.3, 4.0.0 to <4.1.0. Not affected: Vercel, Netlify and AWS Amplify image providers (unless image.ipx is set), Cloudflare Workers and other edge runtimes, and static nuxt generate builds unless the build reads attacker images. Cloudflare shipped an emergency WAF rule (disabled by default, partial coverage) on 2026-10-30. No in-the-wild exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 22:38 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| @nuxt/image | npm | >= 2.0.0, < 2.2.1 | 2.2.1 |
| @nuxt/image | npm | >= 1.0.0, < 1.11.2 | 1.11.2 |
| @nuxt/image | npm | >= 0.6.0, < 1.0.0 | – |
| ipx | npm | < 2.1.2, >= 3.0.0 < 3.1.3, >= 4.0.0-0 < 4.1.0 | 2.1.2, 3.1.3, 4.1.0 |
npm ls @nuxt/image ipx and compare against the affected rangesipx)Upgrade @nuxt/image to 2.2.1 or 1.11.2 and confirm npm ls ipx resolves to 4.1.0, 3.1.3 or 2.1.2 (ipx is an optional dependency, so upgrade it directly if you also depend on it). Move off 0.x. On 2.2.1, consider image.ipx.restrictDecoders if any source is untrusted. Until patched: register your own /_ipx handler returning 404, or block /_ipx/** at the reverse proxy; keep uploads out of served paths and restrict image.domains to hosts you control. Restricting modifiers does not help. Cloudflare users can enable Managed Ruleset rule ...5b82bffe ('Nuxt Image / IPX - Explicit GIF or Animation Modifier Exposure'), but it is only partial coverage.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("TECH-202610-nuxt-image-s-default-ipx-route-lets-one-crafted-image-crash-")