Malicious traffic trying to exploit path traversal in `@netlify/ipx` dependency `sharp`

Support
, ,
3

Thanks for the reply, and I’m glad Netlify will be fine. But it doesn’t solve my problem of the site being overwhelmed with spam requests triggering the “Next.js Server Handler” function. If I don’t stop that, all of my Netlify sites will be taken down within a few days.

I’m having the same problem as the folks in this other thread from 2023.

My site is just a single page site which could be static, so I tried adding this to my next.config.js:

const nextConfig = {
  output: 'export',
};

I also created a custom netlify.toml for my project like this:

[build]
command = "npm run build"
publish = ".next"

And set an environment variable on the Netlify site:

NETLIFY_NEXT_PLUGIN_SKIP="true"

The “Next.js Server Handler” is still there in the function logs. Is that expected?? I don’t know why a server function is created when I turned off the plugin and created a static site.

The serverless function is still being called when I go to a non-existant URL on the site, so it doesn’t seem like the problem is resolved. I fully expect the bot to return once I leave the site on for awhile.

The OP in that other thread worked around the problem with redirects. Based on the Netlify docs, I tried setting a custom 404 page:

netlify.toml

[[redirects]]
    from = "/*"
    to = "/my404.html"
    status = 404

pages/my404.js

export default function Custom404() {
  return <h1>404 - Page Not Found</h1>;
}

However, this page isn’t displaying when the user’s URL isn’t found, it’s still the standard NextJS one. And, of course, the serverless function is still being called. So what is the solution? I’m very confused how this can be a problem with something that’s supposed to be an SSG site.

As suggested in the other thread, I could attempt to block paths with individual redirect rules… but I don’t know what any of the paths are, since the function log doesn’t include the path which generated the function call. :face_with_rolling_eyes: Would be interested to learn how to find out what these failed URL paths are.

Update: Just to clarify, all of the above is after I’ve updated the site to NextJS 15.2.1.