AIKIDO-2024-10175
@cloudflare/next-on-pages is vulnerable to Server-Side Request Forgery (SSRF)
60
Medium Risk
This Affects:
@cloudflare/next-on-pagesTL;DR
Due to a vulnerability in the image optimization functionality of next, the package is vulnerable to server-side request forgery (SSRF). Protocol-relative URLs are not treated as actual relative URLs.
Who does this affect?
You are affected if you are using a @cloudflare/next-on-pages version which is within vulnerability ranges.
Background info
@cloudflare/next-on-pages is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.4.0 - 1.12.0.
How to fix this
Upgrade the @cloudflare/next-on-pages library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.