Nuxt Image v1.11.2

v1.11.1 is a security release.

🚨 Security release

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^2.1.2, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Input formats are unchanged on this release line; the mitigation is the ipx upgrade itself.

👉 Changelog

compare changes

🩹 Fixes

• ipx: require patched ipx for /_ipx route (GHSA-p5vf-pjf5-ggj3) (f105285)
• build: run nuxt-module-build prepare in prepack (110bbe3)

🤖 CI

• automate 1.x releases with uppt (bb9669a)

❤️ Contributors

• Daniel Roe (@danielroe)