CVE-2024-47831 Next.js image optimization has Denial of Service condition
Attackers can cause excessive CPU consumption leading to Denial of Service in Next.js image optimization, affecting standard configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47831?
CVE-2024-47831 is a medium-severity denial of service vulnerability in Vercel Next.js, published on 14 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Next.js is a React Framework for the Web. Cersions on the 10.x, 11.x, 12.x, 13.x, and 14.x branches before version 14.2.7 contain a vulnerability in the image optimization feature which allows for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption. Neither the `next.config.js` file that is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value nor the Next.js application that is hosted on Vercel are affected. This issue was fully patched in Next.js `14.2.7`. As a workaround, ensure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.
Weakness: CWE-674
Which versions are affected by CVE-2024-47831?
2 open source packages ship an affected version, including next. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
next npm | From 10.0.0 | 14.2.7 |
next npm | From 10.0.0 | 14.2.7 |
Products include Vercel Next.js.
How do I fix CVE-2024-47831?
Upgrade next to 14.2.7 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-47831 being exploited?
There is no known exploitation of CVE-2024-47831 in the wild and no public exploit code.
Other vulnerabilities in Vercel Next.js
- CVE-2025-29927 Authorization Bypass in Next.js Middleware
- CVE-2026-44578 Next.js: Server-side request forgery in applications using WebSocket upgrades
- CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
- CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
- CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
Sources
Also known as GHSA-g77x-44xx-532m, MINI-xgjh-vx4f-288g, ROOT-APP-NPM-CVE-2024-47831.