CVE-2022-23646

score

<0.1

cvss

5.9

epss

1.8%

published

2022-02-17

kev added

—

first seen

2026-10-21

Next.js versions 10.0.0 to before 12.1.0 contain a UI misrepresentation of critical information caused by allowing user-provided SVG images via the images.domains configuration in next.config.js, letting attackers deceive users, exploit requires the presence of images.domains with SVG host and default image loader.