CVE-2024-47831: Next.js image optimization has Denial of Service condition
Impact The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.
Not affected: - The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value. - The Next.js application is hosted on Vercel.
Patches This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.
Workarounds Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.
Credits Brandon Dahler (brandondahler), AWS Dimitrios Vlastaras
Other sources
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the next.config.js file that is configured with images.unoptimized set to true or images.loader set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js 14.2.7. As a workaround, ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47831?
CVE-2024-47831 is classified as a Denial of Service (DoS) vulnerability that can lead to excessive CPU consumption.
How do I fix CVE-2024-47831?
To mitigate CVE-2024-47831, update Next.js to version 14.2.7 or higher.
Which versions of Next.js are affected by CVE-2024-47831?
CVE-2024-47831 affects Next.js versions between 10.0.0 and 14.2.7.
What component of Next.js is impacted by CVE-2024-47831?
CVE-2024-47831 impacts the image optimization feature of Next.js.
Is there a configuration to prevent CVE-2024-47831?
Yes, setting the `images.unoptimized` configuration in `next.config.js` can help avoid the vulnerability.