CVE-2024-47831
Description
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
How to fix
- vercel next.js14.2.7 or later
- next14.2.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vercel next.js | 10.0.0 ≤ v < 14.2.7 | 14.2.7 |
| nextnpm | 10.0.0 ≤ v < 14.2.7 | 14.2.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.