CVE-2025-54387 is a critical (CVSS 9.8) path traversal in unjs ipx, the image optimizer behind many Nuxt and Node setups. The directory check used a raw string prefix match, so paths could escape allowed directories. Fixed in 1.3.2, 2.1.1 and 3.1.1.
What's affected
- ipx 1.3.1 and below.
- ipx 2.0.0-0 through 2.1.0.
- ipx 3.0.0 through 3.1.0.
- Fixed in 1.3.2, 2.1.1 and 3.1.1.
- The record says the bypass applies when allowed directories do not end with a path separator.
The record lists CVSS 9.8 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Find ipx in your dependency tree.
npm ls ipx
Or with pnpm or yarn.
pnpm why ipx
yarn why ipx
Then look at how your allowed directories are configured. If a directory path has no trailing slash, the prefix issue applies to you.
What to do now
- Upgrade to 1.3.2, 2.1.1 or 3.1.1 or later, matching your major version.
- Add a trailing path separator to configured allowed directories as a stopgap.
- Check for sibling folders that share a name prefix with an allowed folder.
- Regenerate your lockfile and rebuild any deployed images.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-22. A string prefix test says that /data/images-private starts with /data/images, so it passes. Path checks should compare canonical paths by component, not by characters.
ipx is usually a transitive dependency, so many teams do not know they ship it. Reachability analysis helps separate the services that really expose the image endpoint from those that only carry the package.
Severity scores are a starting point. The score for this entry is 9.8, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a missing trailing slash matter?
Without it, a different folder whose name starts with the same text also matches the prefix check.
Is there a fix for every major version?
Yes, the advisory lists 1.3.2, 2.1.1 and 3.1.1.
Sources
- https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214
- https://github.com/unjs/ipx/releases/tag/v1.3.2
- https://github.com/unjs/ipx/releases/tag/v2.1.1
- https://github.com/unjs/ipx/releases/tag/v3.1.1
- https://github.com/unjs/ipx/security/advisories/GHSA-mm3p-j368-7jcr
Last reviewed: 18 October 2026.
