{"id":"CVE-2024-47831","published":"2024-10-14T18:04:25Z","modified":"2024-10-15T14:52:10Z","title":"Next.js image optimization has Denial of Service condition","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00732,"percentile":0.54332,"provenance":"source"},"cwes":[{"id":"CWE-674","name":"Uncontrolled Recursion"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a","tags":["x_refsource_MISC"]}],"priority":{"score":15.0,"factors":[{"name":"EPSS percentile","points":10.87},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":[">= 10.0.0, < 14.2.7"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=10.0.0, <14.2.7"],"patched":["14.2.7"],"from":["GHSA-g77x-44xx-532m"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3043","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-39693","published":"2024-07-10","fixed":"13.5.0","kev":false},{"cve":"CVE-2024-34350","published":"2024-05-09","fixed":"13.5.1","kev":false},{"cve":"CVE-2024-34351","published":"2024-05-09","fixed":"14.1.1","kev":false,"link":{"from":"CVE-2024-34351","to":"CVE-2024-47831","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"14.1.1","toFixed":"14.2.7","daysApart":158}]}},{"cve":"CVE-2024-47831","published":"2024-10-14","fixed":"14.2.7","kev":false},{"cve":"CVE-2024-46982","published":"2024-09-17","fixed":"14.2.10","kev":false},{"cve":"CVE-2024-51479","published":"2024-12-17","fixed":"14.2.15","kev":false},{"cve":"CVE-2024-56332","published":"2025-01-03","fixed":"15.1.2","kev":false}],"package":"npm:next"}}