Packages / next / Security

HighVulnerabilityGHSA-77r5-gw3j-2mpfCVE-2024-34350Published 9 May 2024

Next.js Vulnerable to HTTP Request Smuggling

Affected releases · next

  • 13.x13.4.0 – 13.5.0Fixed in 13.5.1

On 13.x, the newest line:

npm install next@13.5.1
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

13.x

  1. Not affected

    13.0.0 – 13.3.4

    25 releases

  2. Affected

    13.4.0 – 13.5.0

    20 releases

  3. Fixed

    13.5.1 – 13.5.11

    11 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.

For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.

Patches

The vulnerability is resolved in Next.js 13.5.1 and newer. This includes Next.js 14.x.

Workarounds

There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version.

References

portswigger.net/web-security/request-smuggling/…