LIFF SDK Security Update: Prepare for November 2026 Restrictions

If your LIFF or LINE MINI App uses LIFF SDK v2.20.0–v2.31.0, update to v2.31.1 or later immediately. LINE has disclosed an XSS vulnerability and plans to restrict affected versions around November 24, 2026. Verify the SDK actually loaded by the published application—not just the dependency declaration. The date is an approximate planned restriction, not a reason to postpone the security update.

Key takeaways

• The affected range and minimum fixed version come from LINE’s security notice.
• CDN edge, fixed-version CDN, and npm installations require different checks.
• Test external-browser entry points as well as normal LIFF links.
• A fallback must not restore an affected SDK; message webhooks are a separate integration boundary.

What LINE’s LIFF SDK warning covers

LINE’s October 20 notice describes arbitrary JavaScript execution on the application’s domain under certain conditions when a malicious URL opens a LIFF or LINE MINI App in an external browser. Authentication information, such as access tokens, and information displayed on screen could be exposed.

The notice also clarifies an important entry-path distinction: opening the application’s endpoint URL in LINE’s in-app browser, rather than using a LIFF URL, is treated as an external-browser flow and is also affected. Testing only the familiar LIFF entry point therefore leaves part of the deployment unchecked.

LINE’s 2026 news gives the planned restriction timing as around November 24. The security notice says affected applications opened in an external browser may not function properly once restrictions begin. Do not turn that into a guaranteed outage time, a universal error code, or a claim that every LINE integration will stop.

Audit the shipped SDK, not only package.json

LINE documents SDK integration through a CDN or npm in its LIFF development guide. Use this recommended inventory for each deployed application:

Installation	Inspect	Remediation and evidence
CDN edge path	Script loaded by the published page	LINE’s release notes describe automatic updates; still confirm the version the page actually loads
Fixed-version CDN path	Version in the deployed script URL	Change an affected pinned version to a fixed release and verify the published page
npm package	Resolved @line/liff version, lockfile, and shipped bundle	Update the dependency, rebuild, redeploy, and confirm the runtime version

The release notes distinguish these update paths. The minimum fix is v2.31.1; this is not a claim that v2.31.1 is the newest release. Read the notes for your chosen newer version before deployment.

For each entry, record an owner, production URL, integration method, resolved version, deployed build identifier, and verification time. These are suggested application records, not LINE API fields. Include less-visible landing pages and shared frontend packages if they load LIFF.

With the SDK loaded, the documented environment methods provide a small diagnostic check:

console.log(liff.getVersion());
console.log(liff.isInClient());

Run this in a controlled diagnostic context. Do not add access tokens, ID tokens, or full login URLs to logs. A version observation helps establish what loaded; it is not a complete security assessment.

Make deployment and fallback separate gates

The following is a recommended release checklist, not a report of tests already performed:

1. Change the dependency at its real source. Update the fixed script reference or npm package and lockfile. A manifest edit alone does not replace an existing production bundle.
2. Publish and inspect the actual artifact. If your application uses caches or a service worker, verify that returning visitors also receive the corrected build. Check production, not only a local development page.
3. Exercise legitimate entry paths. Test the LIFF URL, supported external-browser flow, and any endpoint URL your application exposes in LINE’s in-app browser. Use normal test links, not exploit payloads.
4. Check the user journey. Confirm initialization, sign-in return, navigation, and the LIFF functions your app actually uses. For sharing, use the separate custom action button checklist rather than treating page load as proof that sharing works.
5. Review configuration changes separately. If the rollout also changes MINI App console settings, consult the re-review and release-control guide. A deployed JavaScript bundle and an approved console configuration are different evidence.
6. Prepare a fixed-version fallback. Retain a tested artifact with the security update. Do not restore an affected SDK to recover a broken feature; reduce functionality or use a controlled maintenance page instead.

If you suspect exposure, preserve redacted evidence and involve your security owner. Updating the SDK addresses this dependency issue; it does not establish whether earlier sessions or data were affected.

Keep support-message intake separate

UnifyPort’s unofficial interface connects an ordinary LINE messaging account through its LINE authorization flow. Its documented QR URL and PIN arrive asynchronously through webhooks. This is not LIFF website initialization and does not update your application’s SDK.

For an existing integration, test supported message.received intake independently from the MINI App frontend. A working inbox does not prove the frontend is patched, and a failed LIFF page does not by itself identify a webhook failure. UnifyPort cannot remove LINE’s SDK restrictions or repair a vulnerable bundle.

FAQ

Can I wait until November 24 to upgrade?

LINE says to update immediately. Around November 24 is the planned restriction timing, not a safe waiting period or an exact guaranteed cutoff.

Is changing the npm version enough?

No. Confirm the resolved dependency, rebuild and deploy the application, then inspect the loaded version on the published page.

Does opening the page inside LINE eliminate this concern?

No. LINE specifically includes endpoint URLs opened in its in-app browser as external-browser flows. Entry URL and execution context matter.

Does this mean Messaging API webhooks need a new SDK?

The notice concerns LIFF SDK usage in LIFF and MINI Apps. Inspect the affected frontend dependency; do not infer a separate webhook migration from this notice.

Next step and sources

Start with LINE’s security notice, inventory every production LIFF entry point, and attach loaded-version evidence to the rollout review.

Official sources checked on 2026-11-08:

• LINE: LIFF SDK vulnerability and older-version restrictions
• LINE: 2026 announcements and planned restriction timing
• LINE: LIFF release notes
• LINE: Developing a LIFF app