Nuxt Image patches an unauthenticated RCE, upgrade to 2.2.1
A crafted multi-page image sent to the default /_ipx route can corrupt server memory with no login required. Cloudflare shipped an emergency WAF rule the same day.
Nuxt’s image module, @nuxt/image, patched a High-severity vulnerability in its default /_ipx route on 30 October. An integer overflow in the ipx dependency’s multi-page image decoder, which handles formats like TIFF, GIF, WebP and AVIF, lets a single unauthenticated request corrupt memory in the server process, crashing it or potentially running code with its privileges.
The advisory rates it CVSS 8.1 and has not yet been assigned a CVE. It affects @nuxt/image 2.0.0 up to but not including 2.2.1, and 1.0.0 up to but not including 1.11.2; the 0.x line has no fix since it is end of life. Versions 2.2.1 and 1.11.2 close the hole by rejecting oversized multi-page images with a 400 response before decoding them. Cloudflare shipped a disabled-by-default emergency WAF rule for the issue the same day, which gives only partial coverage until you patch.
npm install @nuxt/image@2.2.1Why it matters: if your deployment serves /_ipx without authentication and anything in your app lets an attacker’s bytes reach it, through uploads, user-supplied URLs or similar, this is remotely triggerable by anyone, no login needed. Upgrade now rather than relying on the Cloudflare rule, which is off by default and explicitly partial.
The caveat: with no CVE assigned yet, scanners that key off CVE IDs will not flag this until one is issued.