{"record":{"id":"8713979782999fd3","repo":"vercel/next.js","slug":"url-parameter-is-valid-but-image-type-is-not-all","errorCode":null,"errorMessage":"\"url\" parameter is valid but image type is not allowed","messagePattern":"\"url\" parameter is valid but image type is not allowed","errorType":"http","errorClass":"ImageError","httpStatus":400,"severity":"error","filePath":"packages/next/src/server/image-optimizer.ts","lineNumber":1106,"sourceCode":"      Log.error(\n        \"The requested resource isn't a valid image for\",\n        href,\n        'received',\n        upstreamType\n      )\n    }\n    throw new ImageError(400, \"The requested resource isn't a valid image.\")\n  }\n  if (\n    upstreamType.startsWith('image/svg') &&\n    !nextConfig.images.dangerouslyAllowSVG\n  ) {\n    if (!opts.silent) {\n      Log.error(\n        `The requested resource \"${href}\" has type \"${upstreamType}\" but dangerouslyAllowSVG is disabled. Consider adding the \"unoptimized\" property to the <Image>.`\n      )\n    }\n    throw new ImageError(\n      400,\n      '\"url\" parameter is valid but image type is not allowed'\n    )\n  }\n  if (ANIMATABLE_TYPES.includes(upstreamType) && isAnimated(upstreamBuffer)) {\n    if (!opts.silent) {\n      Log.warnOnce(\n        `The requested resource \"${href}\" is an animated image so it will not be optimized. Consider adding the \"unoptimized\" property to the <Image>.`\n      )\n    }\n    return {\n      buffer: upstreamBuffer,\n      contentType: upstreamType,\n      maxAge,\n      etag: upstreamEtag,\n      upstreamEtag,\n    }\n  }","sourceCodeStart":1088,"sourceCodeEnd":1124,"githubUrl":"https://github.com/vercel/next.js/blob/0ae8c72462952df163f1b1e0726641bc5b40dc93/packages/next/src/server/image-optimizer.ts#L1088-L1124","documentation":"Thrown by imageOptimizer when the fetched content is detected as image/svg but the Next.js config has images.dangerouslyAllowSVG set to false (the default). SVGs are disabled by default because they can carry XSS/script payloads; the optimizer refuses them unless explicitly allowed.","triggerScenarios":"An <Image> points to an .svg file (internal or external) and the project's next.config.js does not enable dangerouslyAllowSVG: true.","commonSituations":"Using SVG logos/icons through next/image without reading the security implications, or a CDN that serves an SVG for a requested .png URL.","solutions":["If you trust the SVG source, enable it in next.config.js: images: { dangerouslyAllowSVG: true } and add a Content-Security-Policy for safety.","Prefer rasterizing the SVG to PNG/WebP, or render SVGs with a normal <img>/inline instead of next/image.","Add the `unoptimized` prop to the specific <Image> to bypass the optimizer for that SVG.","Add allowed SVG domains via images.remotePatterns and keep dangerouslyAllowSVG scoped to trusted origins."],"exampleFix":"// before: SVG refused by default\n// next.config.js\nmodule.exports = {}\n\n// after: explicitly allow with a CSP guard\nmodule.exports = {\n  images: {\n    dangerouslyAllowSVG: true,\n    contentDispositionType: 'attachment',\n    contentSecurityPolicy: \"default-src 'self'; script-src 'none'; sandbox;\",\n  },\n}","handlingStrategy":"validation","validationCode":"// At config time, decide explicitly\nconst ALLOW_SVG = process.env.ALLOW_SVG === 'true'\nmodule.exports = { images: { dangerouslyAllowSVG: ALLOW_SVG } }","typeGuard":"function isAllowedImageType(type: string, allowSvg: boolean): boolean {\n  if (type.startsWith('image/svg')) return allowSvg\n  return type.startsWith('image/')\n}","tryCatchPattern":"try {\n  return await optimize(...)\n} catch (e) {\n  if (e instanceof ImageError && e.message.includes('image type is not allowed')) {\n    return originalSvgBytes() // serve unoptimized SVG\n  }\n}","preventionTips":["Only enable dangerouslyAllowSVG for trusted, first-party SVGs.","Add a strict CSP when enabling SVG.","Use `unoptimized` for one-off SVGs instead of a global config change."],"tags":["image-optimizer","svg","security","config"],"analyzedSha":"0ae8c72462952df163f1b1e0726641bc5b40dc93","analyzedAt":"2026-08-06T19:44:29.143Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}