요약
- CVE-2024-47831은(는) next.js (vercel), next에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.73%, 전체 취약점의 54.3%보다 높음.
- 조치: 14.2.7 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| next.js | ≥ 10.0.0, < 14.2.7
| 14.2.7
|
| next npm | ≥ 10.0.0, < 14.2.7
| 14.2.7
|
Description
Impact
The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.
Not affected:
- The
next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
- The Next.js application is hosted on Vercel.
Patches
This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.
Workarounds
Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.
Credits
Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras
NVD description
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free