Packages / next / Security

ModerateVulnerabilityGHSA-wr66-vrwm-5g5xCVE-2022-21721Published 28 Jan 2022

Denial of Service Vulnerability in next.js

Affected releases · next

  • 12.x12.0.0 – 12.0.8Fixed in 12.0.9

On 12.x, the newest line:

npm install next@12.0.9
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

12.x

  1. Affected

    12.0.0 – 12.0.8

    9 releases

  2. Fixed

    12.0.9 – 12.3.7

    24 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

  • Affected: All of the following must be true to be affected by this CVE

    • Next.js versions above v12.0.0

    • Using next start or a custom server

    • Using the built-in i18n support

  • Not affected:

    • Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

Patches

A patch has been released, next@12.0.9, that mitigates this issue. We recommend all affected users upgrade as soon as possible.

Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/_next/ is blocked from reaching the Next.js instance until you upgrade.

For more information

If you have any questions or comments about this advisory:

  • Open an issue in next

  • Email us at security@vercel.com