GitHub Advisoryadvisory · npm

GHSA-fq54-2j52-jc42 Next.js Denial of Service (DoS) condition

HIGH Published 2024-07-10 Modified 2024-11-06 Official page ↗
Aliases
CVE-2024-39693
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2024-07-10

Affected packages

• npm next: >= 13.3.1, < 13.5.0 → fixed in 13.5.0

Description

Impact A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. This vulnerability can affect all Next.js deployments on the affected versions. Patches This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version. Workarounds There are no official workarounds for this vulnerability. Credit • Thai Vu of flyseccorp.com • Aonan Guan (@0dd), Senior Cloud Security Engineer

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References