TS · security

←Previous Next→

no-dangerously-allow-svg

Next.js image configuration enables SVG rendering without the required response hardening

noDangerouslyAllowSvg Rule source Tests Catalog JSON

Why

SVG files can contain scripts and other active content; enabling dangerouslyAllowSVG makes the image optimizer serve that content from the application origin.

Fix

Keep dangerouslyAllowSVG disabled. If SVG optimization is required, retain attachment disposition and set the image Content-Security-Policy to script-src 'none'; sandbox;.

Examples

Before — flagged Do not enable active SVG delivery

next.config.mjs

export default { images: { dangerouslyAllowSVG: true } };

After — preferred Keep active SVG delivery disabled

next.config.mjs

export default { images: { dangerouslyAllowSVG: false } };