Executive brief
Next.js is a popular React-based web framework used to build modern web applications. The image optimization feature in versions before 14.2.7 contains a flaw that allows attackers to trigger excessive CPU consumption through crafted requests, potentially making the application unavailable to legitimate users. Applications hosted on Vercel or with image optimization disabled are not affected.
Technical details
The vulnerability is an uncontrolled recursion (CWE-674) flaw in Next.js's image optimization component that can lead to excessive CPU consumption and denial of service. The vulnerability affects Next.js versions 10.0.0 through 14.2.6 when using default image optimization settings (images.unoptimized not set to true and images.loader set to default). An unauthenticated attacker can trigger the condition remotely with high attack complexity, causing the application to consume excessive resources. The issue was patched in Next.js 14.2.7; applications can also mitigate by configuring images.unoptimized, images.loader, or images.loaderFile in next.config.js.
Affected products
- Vercel Next.js 10.0.0 through 14.2.6
Timeline
- 2024-10-14: disclosed
- 2024-10-14: patched: Fix available in Next.js 14.2.7