CVE-2022-36046: Unexpected server crash in Next.js version 12.2.3

Published Aug 31, 2022

Updated

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server. Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests.

Affected Software

2 affected components

Vercel Next.js Node.js=12.2.3

Nodejs Node.js>=15.0.0

Event History

Aug 31, 2022

CVE Published

via MITRE·06:55 PM

Data Sourced

via MITRE·06:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-36046?

The severity of CVE-2022-36046 is medium with a severity value of 5.3.

What is affected by CVE-2022-36046?

Next.js version 12.2.3 and Node.js version above v15.0.0 with strict `unhandledRejection` exiting and using next start or a custom server are affected by CVE-2022-36046.

How can I fix CVE-2022-36046?

Update Next.js to version 12.2.4 or later.

Where can I find more information about CVE-2022-36046?

You can find more information about CVE-2022-36046 on the Next.js releases page (https://github.com/vercel/next.js/releases/tag/v12.2.4) and the Next.js security advisories page (https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3).

What is the CWE of CVE-2022-36046?

The CWE of CVE-2022-36046 is 754 and 248.