Packages / next / Security

ModerateVulnerabilityGHSA-wff4-fpwg-qqv3CVE-2022-36046PYSEC-2022-43188Published 30 Aug 2022

Unexpected server crash in Next.js

Affected releases · next

  • 12.x12.2.3Fixed in 12.2.4

On 12.x, the newest line:

npm install next@12.2.4
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

12.x

  1. Not affected

    12.0.0 – 12.2.2

    21 releases

  2. Affected

    12.2.3

    1 release

  3. Fixed

    12.2.4 – 12.3.7

    11 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling.

  • Affected: All of the following must be true to be affected by this CVE

    • Node.js version above v15.0.0 being used with strict unhandledRejection exiting

    • Next.js version v12.2.3

    • Using next start or a custom server

  • Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests.

Patches

github.com/vercel/next.js/releases/tag/v12.2.4