[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"github-release-nuxt-image-v2.2.1":3,"$f2v3tzw7dti6zg":-1},{"adjacent":4,"latestReleases":16,"relatedArticles":23,"relatedArticlesAreVersioned":8,"release":24},{"newer":5,"older":11},{"htmlUrl":6,"id":7,"isPrerelease":8,"name":9,"publishedAt":10,"tagName":9},"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Freleases\u002Ftag\u002Fv1.11.2","01a18e65-f111-750a-a9f3-44b0155c20e9",false,"v1.11.2","2026-10-30T17:02:22.000Z",{"htmlUrl":12,"id":13,"isPrerelease":8,"name":14,"publishedAt":15,"tagName":14},"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Freleases\u002Ftag\u002Fv2.2.0","01a155bf-f85e-72f7-aba7-cfa8b73ddd10","v2.2.0","2026-10-19T17:19:07.000Z",[17,18,19],{"id":7,"isPrerelease":8,"name":9,"publishedAt":10,"tagName":9},{"id":13,"isPrerelease":8,"name":14,"publishedAt":15,"tagName":14},{"id":20,"isPrerelease":8,"name":21,"publishedAt":22,"tagName":21},"019faa50-2457-7760-a752-885324f28569","v2.1.0","2026-07-28T17:45:49.000Z",[],{"htmlUrl":25,"id":26,"isPrerelease":8,"name":27,"projectId":28,"projectName":29,"projectOwner":30,"projectRepo":31,"projectUrl":32,"publishedAt":33,"summary":34,"tagName":27,"updatedAt":35,"breakingChangesHtml":36,"displayName":37,"hasBreakingChanges":8,"indexable":38,"notesHtml":39,"version":40},"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Freleases\u002Ftag\u002Fv2.2.1","01a18e65-f107-77e0-b286-297eb0a918a5","v2.2.1","019d75af-fb33-76be-ad0d-a4fd7f8df6f9","Nuxt Image","nuxt","image","https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage","2026-10-30T16:52:38.000Z","Nuxt Image v2.2.1 is a security release that addresses a vulnerability in the `\u002F_ipx` image transformation route, requiring `ipx ^4.1.0` to prevent integer overflow issues. The update restricts accepted input formats to common web images and introduces new options for managing input formats and decoders for enhanced security.","2026-10-30T20:00:29.255Z",null,"Nuxt Image v2.2.1",true,"\u003Cblockquote>\n\u003Cp>v2.2.1 is a security release.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>🚨 Security\u003C\u002Fh3>\n\u003Cp>This release fixes a vulnerability in the \u003Ccode>\u002F_ipx\u003C\u002Fcode> image transformation route. \u003Ccode>ipx\u003C\u002Fcode> was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Funjs\u002Fipx\u002Fsecurity\u002Fadvisories\u002FGHSA-qf89-6xm4-66wm\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">GHSA-qf89-6xm4-66wm\u003C\u002Fa>; our advisory for the \u003Ccode>@nuxt\u002Fimage\u003C\u002Fcode> side is \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Fsecurity\u002Fadvisories\u002FGHSA-p5vf-pjf5-ggj3\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">GHSA-p5vf-pjf5-ggj3\u003C\u002Fa>). Sites where an attacker cannot control any image source are not affected.\u003C\u002Fp>\n\u003Cp>\u003Ccode>@nuxt\u002Fimage\u003C\u002Fcode> now requires \u003Ccode>ipx ^4.1.0\u003C\u002Fcode>, which rejects oversized multi-page images with a \u003Ccode>400\u003C\u002Fcode> before decoding them. \u003Ccode>ipx\u003C\u002Fcode> is an optional dependency, so after upgrading run \u003Ccode>npm ls ipx\u003C\u002Fcode> to confirm a patched version resolves.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Behaviour change:\u003C\u002Fstrong> \u003Ccode>\u002F_ipx\u003C\u002Fcode> now only accepts common web image formats as input (JPEG, PNG, WebP, GIF, SVG, AVIF, HEIC) and responds \u003Ccode>403\u003C\u002Fcode> to anything else, before decoding it. If you transform other formats (for example TIFF), list them with the new \u003Ccode>image.ipx.allowedInputFormats\u003C\u002Fcode> option. For sources you do not fully trust, also consider \u003Ccode>image.ipx.restrictDecoders\u003C\u002Fcode>, which blocks the decoders of every other format for the whole process.\u003C\u002Fp>\n\u003Ch2>👉 Changelog\u003C\u002Fh2>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Fcompare\u002Fv2.2.0...v2.2.1\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">compare changes\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch3>🩹 Fixes\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>ipx:\u003C\u002Fstrong> require patched ipx and restrict input formats for \u002F_ipx route (GHSA-p5vf-pjf5-ggj3) (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fnuxt\u002Fimage\u002Fcommit\u002F750a4f0\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">\u003Ccode>750a4f0\u003C\u002Fcode>\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>ipx:\u003C\u002Fstrong> use IPXFetchHandler so \u003Ccode>srvx\u002Fnode\u003C\u002Fcode> is not required at runtime (#2336)\u003C\u002Fli>\n\u003Cli>\u003Cstrong>ipx:\u003C\u002Fstrong> import \u003Ccode>NitroRuntimeConfig\u003C\u002Fcode> from \u003Ccode>nitropack\u002Ftypes\u003C\u002Fcode> (#2354)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>🎉 New Contributors\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Chairul Akmal (@chairulakmal)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>❤️ Contributors\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Daniel Roe (@danielroe)\u003C\u002Fli>\n\u003Cli>Chairul Akmal (@chairulakmal)\u003C\u002Fli>\n\u003Cli>Luke Nelson (@luc122c)\u003C\u002Fli>\n\u003C\u002Ful>\n","2.2.1"]