CVE-2022-21721: DOS Vulnerability in next.js
Impact
Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.
- Affected: All of the following must be true to be affected by this CVE - Next.js versions above v12.0.0 - Using next start or a custom server - Using the built-in i18n support - Not affected: - Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.
Patches
A patch has been released, next@12.0.9, that mitigates this issue. We recommend all affected users upgrade as soon as possible.
Workarounds
We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/next/ is blocked from reaching the Next.js instance until you upgrade.
For more information
If you have any questions or comments about this advisory: Open an issue in next Email us at security@vercel.com
Other sources
Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, next@12.0.9, that mitigates this issue. As a workaround, one may ensure /${locale}/next/ is blocked from reaching the Next.js instance until it becomes feasible to upgrade.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-21721?
CVE-2022-21721 is a vulnerability in Next.js framework prior to version 12.0.9 that could allow a denial of service attack for users using i18n functionality.
How can a bad actor exploit CVE-2022-21721?
A bad actor can exploit CVE-2022-21721 by triggering a denial of service attack on Next.js applications that use i18n functionality.
What is the severity of CVE-2022-21721?
CVE-2022-21721 has a severity score of 7.5 (high).
How can I fix CVE-2022-21721?
To fix CVE-2022-21721, upgrade Next.js to version 12.0.9 or later.
Where can I find more information about CVE-2022-21721?
You can find more information about CVE-2022-21721 on the GitHub security advisory page: https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x