GitHub Advisoryadvisory · npm

GHSA-wff4-fpwg-qqv3 Unexpected server crash in Next.js

MEDIUM Published 2022-08-30 Modified 2022-09-08 Official page ↗
Aliases
CVE-2022-36046
Ecosystem
npm
Packages
next
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248, CWE-754
Reviewed
2022-08-30

Affected packages

• npm next: >= 12.2.3, < 12.2.4 → fixed in 12.2.4

Description

Impact When specific requests are made to the Next.js server it can cause an `unhandledRejection` in the server which can crash the process to exit in specific Node.js versions with strict `unhandledRejection` handling. • Affected: All of the following must be true to be affected by this CVE • Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting • Next.js version v12.2.3 • Using next start or a custom server • Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where `next-server` isn't being shared across requests. Patches https://github.com/vercel/next.js/releases/tag/v12.2.4

Related

Alias · CVE (1)

  • CVE-2022-36046 Next.js is a React framework that can provide building blocks to create web applications. vulnerability

Weakness · CWE (2)

  • CWE-248 Uncaught Exception weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References