CVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the _next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These custom attacker images can also become permanently stored on the victim’s website, even if the attacker stops their Ngrok or Apache service.

Attackers can use tunneling tools like Ngrok or an Apache server to deliver malicious images from their local systems. Additionally, introducing delays in the script can help circumvent protections on servers that enforce timing-based upload restrictions.