{"id":"CVE-2024-47831","aliases":["EUVD-2024-3043","GHSA-g77x-44xx-532m","ROOT-APP-NPM-CVE-2024-47831"],"status":"published","title":"Next.js image optimization has Denial of Service condition","description":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00732,"percentile":0.54763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2024-10-14T18:04:25Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"npm","package":"next","fixed_in":["14.2.7"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"next","fixed_in":["13.5.11-aikido.7","13.5.11-aikido.4","13.5.11-aikido.8","13.5.11-aikido.5","13.5.11-aikido.6","13.5.11-aikido.9","13.5.11-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/next","fixed_in":["13.5.11-root.io.7","13.5.11-root.io.4","13.5.11-root.io.8","13.5.11-root.io.5","13.5.11-root.io.6","13.5.11-root.io.9","13.5.11-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"14.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"next","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"14.2.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.5.11-aikido.7"},{"fixed":"13.5.11-aikido.4"},{"fixed":"13.5.11-aikido.8"},{"fixed":"13.5.11-aikido.5"},{"fixed":"13.5.11-aikido.6"},{"fixed":"13.5.11-aikido.9"},{"fixed":"13.5.11-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/next","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.5.11-root.io.7"},{"fixed":"13.5.11-root.io.4"},{"fixed":"13.5.11-root.io.8"},{"fixed":"13.5.11-root.io.5"},{"fixed":"13.5.11-root.io.6"},{"fixed":"13.5.11-root.io.9"},{"fixed":"13.5.11-root.io.3"}]}]}],"products":[{"vendor":"vercel","product":"next.js"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vercel/next.js/commit/d11cbc9ff0b1aaefabcba9afe1e562e0b1fde65a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47831","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g77x-44xx-532m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47831.json","tags":["advisory"]},{"url":"https://github.com/vercel/next.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-47831","title":"Next.js image optimization has Denial of Service condition","description":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","status":"published","published":"2024-10-14T18:04:25.927Z","modified":"2024-10-15T14:52:10.465Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:33:57.638551Z"}],"euvd":[{"id":"EUVD-2024-3043","description":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","status":"published","published":"2024-10-14T18:04:25Z","modified":"2024-10-15T14:52:10Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:27:37.250145Z"}],"ghsa":[{"id":"GHSA-g77x-44xx-532m","title":"Denial of Service condition in Next.js image optimization","description":"### Impact\nThe image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.\n\n**Not affected:**\n- The `next.config.js` file is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value.\n- The Next.js application is hosted on Vercel. \n\n### Patches\nThis issue was fully patched in Next.js `14.2.7`. We recommend that users upgrade to at least this version.\n\n### Workarounds\nEnsure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.\n\n#### Credits\nBrandon Dahler (brandondahler), AWS\nDimitrios Vlastaras","status":"published","published":"2024-10-14T19:45:21Z","modified":"2024-11-08T18:55:49Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:38:16.477822Z"}],"nvd":[{"id":"CVE-2024-47831","description":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","status":"published","published":"2024-10-14T18:15:05.013Z","modified":"2026-06-17T07:57:50.04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:10:31.879321Z"}],"osv":[{"id":"CVE-2024-47831","title":"Next.js image optimization has Denial of Service condition","description":"Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.","status":"published","published":"2024-10-14T18:04:25.927Z","modified":"2026-10-28T02:30:58.284253618Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:43.253252Z"},{"id":"GHSA-g77x-44xx-532m","title":"Denial of Service condition in Next.js image optimization","description":"### Impact\nThe image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.\n\n**Not affected:**\n- The `next.config.js` file is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value.\n- The Next.js application is hosted on Vercel. \n\n### Patches\nThis issue was fully patched in Next.js `14.2.7`. We recommend that users upgrade to at least this version.\n\n### Workarounds\nEnsure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.\n\n#### Credits\nBrandon Dahler (brandondahler), AWS\nDimitrios Vlastaras","status":"published","published":"2024-10-14T19:45:21Z","modified":"2026-09-10T03:50:19.720748758Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"ROOT-APP-NPM-CVE-2024-47831","title":"CVE-2024-47831 in next - Patched by Root","description":"Root has patched CVE-2024-47831 in the next package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-22T11:23:10Z","modified":"2026-09-22T12:15:03.379991132Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}