更新: 2531 个文件 - 2026-03-17 21:00:03

08-threat-intel/registry/advisories/nextjs--CVE-2024-47831.json

@@ -5,11 +5,11 @@
   "category": "frameworks",
   "advisory_mode": "core",
   "title": "Denial of Service condition in Next.js image optimization",
-  "summary": "### Impact\nThe image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.\n\n**Not affected:**\n- The `next.config.js` file is configured with `images.unoptimized` set to `true` or `images.loader` set to a non-default value.\n- The Next.js application is hosted on Vercel. \n\n### Patches\nThis issue was fully patched in Next.js `14.2.7`. We recommend that users upgrade to at least this version.\n\n### Workarounds\nEnsure that the `next.config.js` file has either `images.unoptimized`, `images.loader` or `images.loaderFile` assigned.\n\n#### Credits\nBrandon Dahler (brandondahler), AWS\nDimitrios Vlastaras",
+  "summary": "Denial of Service condition in Next.js image optimization",
   "published_at": "2024-10-14T19:45:21Z",
   "updated_at": "2026-02-04T03:25:43.295558Z",
   "severity": "low",
-  "cvss_score": 3.1,
+  "cvss_score": null,
   "exploit_status": "unknown",
   "source_confidence": "official",
   "official_source_url": "https://github.com/vercel/next.js/security/advisories/GHSA-g77x-44xx-532m",
@@ -28,9 +28,7 @@
   "ghsa_ids": [
     "GHSA-g77x-44xx-532m"
   ],
-  "osv_ids": [
-    "GHSA-g77x-44xx-532m"
-  ],
+  "osv_ids": [],
   "affected_versions": [
     "introduced=10.0.0, fixed<14.2.7"
   ],
@@ -50,23 +48,19 @@
   "verification_status": "triage-manual",
   "verification_mode": "synthetic",
   "last_verified_at": null,
-  "last_run_id": null,
+  "last_run_id": "",
   "evidence_bundle": null,
   "browser_evidence": {
     "required": false,
     "present": false,
     "refs": []
   },
-  "repro_profile_id": "proxy-boundary-generic",
+  "repro_profile_id": "nextjs-authz-bypass",
   "artifact_mode": "synthetic",
   "blocked_reason": null,
   "metadata": {
-    "source_names": [
-      "OSV Next.js"
-    ],
-    "source_kinds": [
-      "osv-batch"
-    ],
+    "source_names": [],
+    "source_kinds": [],
     "candidate_count": 1
   }
 }