please note, this only affects the default `ipx` provider on server deployments.
platform-specific providers and edge/worker runtimes don't register the route.
you can find out more in:
👉 `@nuxt/image`: github.com/nuxt/image/security/advisories/GHSA-p5…
👉 `ipx`: github.com/unjs/ipx/security/advisories/GHSA-qf89…
4 likes
please note, this only affects the default `ipx` provider on server deployments.
platform-specific providers and edge/worker runtimes don't register the route.
you can find out more in:
👉 `@nuxt/image`: github.com/nuxt/image/security/advisories/GHSA-p5…
👉 `ipx`: github.com/unjs/ipx/security/advisories/GHSA-qf89…
6 likes · 639 views
🚨 `@nuxt/image` security update 🚨
a single unauthenticated request to the default `/_ipx` route can crash your server, and may allow remote code execution, via a crafted multi-page image.
👉 this is fixed in 2.2.1 and 1.11.2, by bumping `ipx`
github.com/nuxt/image/releases/tag/v2.2.1
19 likes · 5 reposts
🚨 `@nuxt/image` security update 🚨
a single unauthenticated request to the default `/_ipx` route can crash your server, and may allow remote code execution, via a crafted multi-page image.
👉 this is fixed in 2.2.1 and 1.11.2, by bumping `ipx`
github.com/nuxt/image/releases/tag/v2.2.1
68 likes · 3 reposts · 4,791 views
I discovered a pre-auth RCE vulnerability affecting Nuxt applications through IPX.
Thank you, @nuxt_js for the opportunity to contribute to the security of the Nuxt ecosystem.
unjs/IPX: github.com/unjs/ipx/security/advisories/GHSA-qf89…
nuxt/image:github.com/nuxt/image/security/advisories/GHSA-p5…
#Nuxt #IPX #SecurityResearch
1 like · 29 views
Mentions
please note, this only affects the default `ipx` provider on server deployments. platform-specific providers and edge/worker runtimes don't register the route. you can find out more in: 👉 `@nuxt/image`: github.com/nuxt/image/security/advisories/GHSA-p5… 👉 `ipx`: github.com/unjs/ipx/security/advisories/GHSA-qf89…
please note, this only affects the default `ipx` provider on server deployments. platform-specific providers and edge/worker runtimes don't register the route. you can find out more in: 👉 `@nuxt/image`: github.com/nuxt/image/security/advisories/GHSA-p5… 👉 `ipx`: github.com/unjs/ipx/security/advisories/GHSA-qf89…
🚨 `@nuxt/image` security update 🚨 a single unauthenticated request to the default `/_ipx` route can crash your server, and may allow remote code execution, via a crafted multi-page image. 👉 this is fixed in 2.2.1 and 1.11.2, by bumping `ipx` github.com/nuxt/image/releases/tag/v2.2.1
🚨 `@nuxt/image` security update 🚨 a single unauthenticated request to the default `/_ipx` route can crash your server, and may allow remote code execution, via a crafted multi-page image. 👉 this is fixed in 2.2.1 and 1.11.2, by bumping `ipx` github.com/nuxt/image/releases/tag/v2.2.1
I discovered a pre-auth RCE vulnerability affecting Nuxt applications through IPX. Thank you, @nuxt_js for the opportunity to contribute to the security of the Nuxt ecosystem. unjs/IPX: github.com/unjs/ipx/security/advisories/GHSA-qf89… nuxt/image:github.com/nuxt/image/security/advisories/GHSA-p5… #Nuxt #IPX #SecurityResearch