PT-2024-7169 · Vercel · Next.Js

Brandon Dahler + 1 · Published 2024-10-14 · Updated 2024-11-08 · CVE-2024-47831

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions 10.x through 14.x before version 14.2.7

Description The issue is related to the image optimization feature in Next.js, which contains a vulnerability allowing for a potential Denial of Service (DoS) condition that could lead to excessive CPU consumption due to uncontrolled recursion. This could be exploited by a remote attacker. The next.config.js file configured with images.unoptimized set to true or images.loader set to a non-default value, and Next.js applications hosted on Vercel, are not affected.

Recommendations For Next.js versions 10.x through 14.x before version 14.2.7, upgrade to version 14.2.7 or later to secure your setup. As a temporary workaround, ensure that the next.config.js file has either images.unoptimized, images.loader, or images.loaderFile assigned.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

BDU:2024-08508

CVE-2024-47831

GHSA-G77X-44XX-532M

Affected Products

Next.Js

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47831.json · Exploit
• https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a · Patch
• https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47831 · Security Note
• https://osv.dev/vulnerability/GHSA-g77x-44xx-532m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47831 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08508 · Security Note
• https://github.com/vercel/next.js · Note
• https://t.me/cvenotify/101075 · Telegram Post
• https://twitter.com/CVEnew/status/1845892711615971331 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1845999239270183380 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1848219974915047650 · Twitter Post
• https://access.redhat.com/security/cve/cve-2024-47831 · Note
• https://twitter.com/oktsec/status/1845942164758396967 · Twitter Post
• https://t.me/cvedetector/7846 · Telegram Post