TI-2024-32098 Aliases CVE-2024-47831 GHSA-g77x-44xx-532m

Next.js image optimization has Denial of Service condition

LOW 34CWE-674Published 2024-10-14 · Updated 2024-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00732 54th percentileScored 2026-11-07

Fix Partial next.js (vercel): 14.2.7next (npm): 14.2.7Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
vercel	next.js	10.0.0 to before 14.2.7	14.2.7	Patch available	CNA
—	next (npm)	10.0.0 to before 14.2.7	14.2.7	Patch available	GHSA-g77x-44xx-532m

next.js Vendorvercel Affected 10.0.0 to before 14.2.7 Fixed in 14.2.7 Patch available CNA
next (npm) Vendor— Affected 10.0.0 to before 14.2.7 Fixed in 14.2.7 Patch available GHSA-g77x-44xx-532m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vercel:next.js::::::node.js::*	10.0.0 to before 14.2.7	Vulnerable	vercel

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 10.0.0 to before 14.2.7 Vulnerable ·vercel

Remediation

Fix · CNA next.js (vercel) Fixed in 14.2.7
Fix · GHSA-g77x-44xx-532m next (npm) Fixed in 14.2.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 9	Affected	No fix planned: Out of support scope

Not affected: 4 products

Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Trusted Artifact Signer

Timeline

2026-10-02 Threatist record created from CVE-2024-47831
2026-10-03 Alias added: GHSA-g77x-44xx-532m

References

Patch 1

https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a

Advisory 2

Other 1

https://github.com/vercel/next.js

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences