GHSA-f87g-xv8r-7p7x: Medium severity npm/next vulnerability
In Next.js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the dynamicParams route segment option. An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from generateStaticParams().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize Next.js App Router applications built with webpack that expose opengraph-image or twitter-image routes for dynamic segments. The issue is relevant where dynamic segments were intentionally omitted from generateStaticParams() and controlled with dynamicParams.
What must an attacker do to exploit this?
An attacker needs only to send requests to metadata image URLs corresponding to dynamic segments that were excluded from generateStaticParams(). The supplied vector indicates network access, low attack complexity, and no required privileges or user interaction.
How can we determine whether an application is affected?
Review metadata image route handling for opengraph-image and twitter-image in webpack-based App Router builds. Determine whether requests for dynamic segment values excluded from generateStaticParams() are still served despite the intended dynamicParams restriction.