Tóm tắt nhanh
- CVE-2024-47831 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng next.js (vercel), next.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.73%, cao hơn 54.3% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 14.2.7 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| next.js | ≥ 10.0.0, < 14.2.7
| 14.2.7
|
| next npm | ≥ 10.0.0, < 14.2.7
| 14.2.7
|
Mô tả
Impact
The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.
Not affected:
- The
next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.
- The Next.js application is hosted on Vercel.
Patches
This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.
Workarounds
Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.
Credits
Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras
Mô tả của NVD
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí