CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.

• CWE-451

• https://github.com/vercel/next.js/pull/34075Issue Tracking, Patch, Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v12.1.0Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mjIssue Tracking, Mitigation, Patch, Third Party Advisory
• https://github.com/vercel/next.js/pull/34075Issue Tracking, Patch, Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v12.1.0Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-fmvm-x8mv-47mjIssue Tracking, Mitigation, Patch, Third Party Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23641Discourse is an open source discussion platform. In versions…6.5
• CVE-2022-23642Sourcegraph is a code search and navigation engine. Sourcegr…8.8
• CVE-2022-23643Sourcegraph is a code search and navigation engine. Sourcegr…6.5
• CVE-2022-23644BookWyrm is a decentralized social network for tracking read…8.8
• CVE-2022-23645swtpm is a libtpms-based TPM emulator with socket, character…5.5
• CVE-2022-23647Prism is a syntax highlighting library. Starting with versio…6.1
• CVE-2022-23648containerd is a container runtime available as a daemon for …7.5
• CVE-2022-23649Cosign provides container signing, verification, and storage…3.3
• CVE-2022-2365Cross-site Scripting (XSS) - Stored in GitHub repository zad…5.4
• CVE-2022-23650Netmaker is a platform for creating and managing virtual ove…8.8
• CVE-2022-23651b2-sdk-python is a python library to access cloud storage pr…4.7