---
title: "Nuxt Image v2.2.1 Release Notes | VueDigest"
description: "Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `/_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent inte…"
canonical_url: "https://vuedigest.com/github-releases/nuxt/image/v2.2.1"
meta:
  "og:description": "Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `/_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent inte…"
  "og:image": "https://vuedigest.com/_og/d/c_Template.takumi%2Cdescription_~TnV4dCBJbWFnZSB2Mi4yLjEgaXMgYSBzZWN1cml0eSByZWxlYXNlIHRoYXQgYWRkcmVzc2VzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgYC9faXB4YCBpbWFnZSB0cmFuc2Zvcm1hdGlvbiByb3V0ZSwgcmVxdWlyaW5nIGBpcHggXjQuMS4wYCB0byBwcmV2ZW50IGludGXigKY%2Ctitle_Nuxt%2BImage%2Bv2.2.1%2Cp_Ii9naXRodWItcmVsZWFzZXMvbnV4dC9pbWFnZS92Mi4yLjEi%2Cs_RrK5zDmFYr7TM-N5.png"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Nuxt Image v2.2.1 Release Notes"
  "twitter:description": "Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `/_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent inte…"
  "twitter:image": "https://vuedigest.com/_og/d/c_Template.takumi%2Cdescription_~TnV4dCBJbWFnZSB2Mi4yLjEgaXMgYSBzZWN1cml0eSByZWxlYXNlIHRoYXQgYWRkcmVzc2VzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgYC9faXB4YCBpbWFnZSB0cmFuc2Zvcm1hdGlvbiByb3V0ZSwgcmVxdWlyaW5nIGBpcHggXjQuMS4wYCB0byBwcmV2ZW50IGludGXigKY%2Ctitle_Nuxt%2BImage%2Bv2.2.1%2Cp_Ii9naXRodWItcmVsZWFzZXMvbnV4dC9pbWFnZS92Mi4yLjEi%2Cs_RrK5zDmFYr7TM-N5.png"
  "twitter:title": "Nuxt Image v2.2.1 Release Notes"
---

> Index of every page on this site: [llms.txt](https://vuedigest.com/llms.txt)

# **Nuxt Image v2.2.1**

[View on GitHub](https://github.com/nuxt/image/releases/tag/v2.2.1)

nuxt/image· Released October 30, 2026

Share [Share on X](https://x.com/intent/tweet?text=Nuxt+Image+v2.2.1&url=https%3A%2F%2Fvuedigest.com%2Fgithub-releases%2Fnuxt%2Fimage%2Fv2.2.1)

**Summary**

Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the \`/\_ipx\` image transformation route, requiring \`ipx ^4.1.0\` to prevent integer overflow issues. The update restricts accepted input formats to common web images and introduces new options for managing input formats and decoders for enhanced security.

## **Full release notes **

> v2.2.1 is a security release.

### 🚨 Security

This release fixes a vulnerability in the `/_ipx` image transformation route. `ipx` was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request ([GHSA-qf89-6xm4-66wm](https://github.com/unjs/ipx/security/advisories/GHSA-qf89-6xm4-66wm); our advisory for the `@nuxt/image` side is [GHSA-p5vf-pjf5-ggj3](https://github.com/nuxt/image/security/advisories/GHSA-p5vf-pjf5-ggj3)). Sites where an attacker cannot control any image source are not affected.

`@nuxt/image` now requires `ipx ^4.1.0`, which rejects oversized multi-page images with a `400` before decoding them. `ipx` is an optional dependency, so after upgrading run `npm ls ipx` to confirm a patched version resolves.

**Behaviour change:** `/_ipx` now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds `403` to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new `image.ipx.allowedInputFormats` option. For sources you do not fully trust, also consider `image.ipx.restrictDecoders`, which blocks the decoders of every other format for the whole process.

## 👉 Changelog

[compare changes](https://github.com/nuxt/image/compare/v2.2.0...v2.2.1)

### 🩹 Fixes

- **ipx:** require patched ipx and restrict input formats for /\_ipx route (GHSA-p5vf-pjf5-ggj3) ([`750a4f0`](https://github.com/nuxt/image/commit/750a4f0))
- **ipx:** use IPXFetchHandler so `srvx/node` is not required at runtime (#2336)
- **ipx:** import `NitroRuntimeConfig` from `nitropack/types` (#2354)

### 🎉 New Contributors

- Chairul Akmal (@chairulakmal)

### ❤️ Contributors

- Daniel Roe (@danielroe)
- Chairul Akmal (@chairulakmal)
- Luke Nelson (@luc122c)

## **Latest Nuxt Image releases **

[All releases](https://vuedigest.com/github-releases/nuxt/image)

- [**v1.11.2**October 30, 2026](https://vuedigest.com/github-releases/nuxt/image/v1.11.2)
- [**v2.2.0**October 19, 2026](https://vuedigest.com/github-releases/nuxt/image/v2.2.0)
- [**v2.1.0**July 28, 2026](https://vuedigest.com/github-releases/nuxt/image/v2.1.0)

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuedigest.com/#website","@type":"WebSite","description":"Your daily dose of Vue.js and Nuxt news. Curated articles, tutorials, and updates from the Vue ecosystem.","inLanguage":"en","name":"VueDigest","url":"https://vuedigest.com","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://vuedigest.com/news?search={search_term_string}"},"query-input":"required name=search_term_string"}],"publisher":{"@id":"https://vuedigest.com/#identity"}},{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#webpage","@type":"WebPage","dateModified":"2026-10-30T20:00:29.255Z","datePublished":"2026-10-30T16:52:38.000Z","description":"Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `/_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent inte…","name":"Nuxt Image v2.2.1 Release Notes","url":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1","breadcrumb":{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#breadcrumb"},"isPartOf":{"@id":"https://vuedigest.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuedigest.com/github-releases/nuxt/image/v2.2.1"]}],"primaryImageOfPage":{"@id":"https://vuedigest.com/#logo"}},{"@id":"https://vuedigest.com/#identity","@type":"Organization","name":"VueDigest","url":"https://vuedigest.com","logo":{"@id":"https://vuedigest.com/#logo"}},{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#article","about":"Nuxt Image 2.2.1","dateModified":"2026-10-30T20:00:29.255Z","datePublished":"2026-10-30T16:52:38.000Z","description":"Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `/_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent inte…","headline":"Nuxt Image v2.2.1 Release Notes","inLanguage":"en","thumbnailUrl":"https://vuedigest.com/_og/d/c_Template.takumi%2Cdescription_~TnV4dCBJbWFnZSB2Mi4yLjEgaXMgYSBzZWN1cml0eSByZWxlYXNlIHRoYXQgYWRkcmVzc2VzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgYC9faXB4YCBpbWFnZSB0cmFuc2Zvcm1hdGlvbiByb3V0ZSwgcmVxdWlyaW5nIGBpcHggXjQuMS4wYCB0byBwcmV2ZW50IGludGXigKY%2Ctitle_Nuxt%2BImage%2Bv2.2.1%2Cp_Ii9naXRodWItcmVsZWFzZXMvbnV4dC9pbWFnZS92Mi4yLjEi%2Cs_RrK5zDmFYr7TM-N5.png","@type":["Article","TechArticle"],"author":{"@id":"https://vuedigest.com/#identity"},"image":{"@id":"https://vuedigest.com/#/schema/image/1"},"isPartOf":{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#webpage"},"keywords":["Nuxt Image","release notes","changelog"],"mainEntityOfPage":{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#webpage"},"publisher":{"@id":"https://vuedigest.com/#identity"}},{"@id":"https://vuedigest.com/github-releases/nuxt/image/v2.2.1#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","item":"https://vuedigest.com/github-releases","name":"GitHub Releases","position":1},{"@type":"ListItem","item":"https://vuedigest.com/github-releases/nuxt/image","name":"Nuxt Image","position":2},{"@type":"ListItem","name":"v2.2.1","position":3}]},{"@id":"https://vuedigest.com/#logo","@type":"ImageObject","caption":"VueDigest","contentUrl":"https://mokkapps.twic.pics/vuedigest.com/logo.png","inLanguage":"en","url":"https://mokkapps.twic.pics/vuedigest.com/logo.png"},{"@id":"https://vuedigest.com/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuedigest.com/_og/d/c_Template.takumi%2Cdescription_~TnV4dCBJbWFnZSB2Mi4yLjEgaXMgYSBzZWN1cml0eSByZWxlYXNlIHRoYXQgYWRkcmVzc2VzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgYC9faXB4YCBpbWFnZSB0cmFuc2Zvcm1hdGlvbiByb3V0ZSwgcmVxdWlyaW5nIGBpcHggXjQuMS4wYCB0byBwcmV2ZW50IGludGXigKY%2Ctitle_Nuxt%2BImage%2Bv2.2.1%2Cp_Ii9naXRodWItcmVsZWFzZXMvbnV4dC9pbWFnZS92Mi4yLjEi%2Cs_RrK5zDmFYr7TM-N5.png","inLanguage":"en","url":"https://vuedigest.com/_og/d/c_Template.takumi%2Cdescription_~TnV4dCBJbWFnZSB2Mi4yLjEgaXMgYSBzZWN1cml0eSByZWxlYXNlIHRoYXQgYWRkcmVzc2VzIGEgdnVsbmVyYWJpbGl0eSBpbiB0aGUgYC9faXB4YCBpbWFnZSB0cmFuc2Zvcm1hdGlvbiByb3V0ZSwgcmVxdWlyaW5nIGBpcHggXjQuMS4wYCB0byBwcmV2ZW50IGludGXigKY%2Ctitle_Nuxt%2BImage%2Bv2.2.1%2Cp_Ii9naXRodWItcmVsZWFzZXMvbnV4dC9pbWFnZS92Mi4yLjEi%2Cs_RrK5zDmFYr7TM-N5.png"}]}
```

## Sitemap

See the full [sitemap](https://vuedigest.com/sitemap.md) for all pages.