Vulnerability · Published Jan 28, 2022 · Assigned by GitHub_M
CVE-2022-21721DOS Vulnerability in next.js
Medium 5.9
In plain English
A medium-severity security flaw in the next package (npm). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | next | 12.0.9 | GHSA-wr66-vrwm-5g5x |
Affected products (as reported)
References
- https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x x_refsource_CONFIRM
- https://github.com/vercel/next.js/pull/33503 x_refsource_MISC
- https://github.com/vercel/next.js/releases/tag/v12.0.9 x_refsource_MISC