What is GHSA-wr66-vrwm-5g5x?

GHSA-wr66-vrwm-5g5x is a security advisory published by GitHub Security Advisories with Medium severity. Denial of Service Vulnerability in next.js

Which CVE IDs does GHSA-wr66-vrwm-5g5x cover?

GHSA-wr66-vrwm-5g5x covers the following CVE IDs: CVE-2022-21721. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wr66-vrwm-5g5x?

GHSA-wr66-vrwm-5g5x has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-wr66-vrwm-5g5x?

GHSA-wr66-vrwm-5g5x affects 1 product, including: npm/next:\u003e= 12.0.0, \u003c 12.0.9.

GHSA-wr66-vrwm-5g5xMediumCVSS 5.9

Denial of Service Vulnerability in next.js

Vendor

GitHub Security Advisories

Published

January 28, 2022

Last Modified

December 20, 2023

🔗 CVE IDs covered (1)

CVE-2022-21721 →

📋 Description

Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

Affected: All of the following must be true to be affected by this CVE
- Next.js versions above v12.0.0
- Using next start or a custom server
- Using the built-in i18n support
Not affected:
- Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

Patches

A patch has been released, [email protected], that mitigates this issue. We recommend all affected users upgrade as soon as possible.

Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/_next/ is blocked from reaching the Next.js instance until you upgrade.

For more information

If you have any questions or comments about this advisory:

Open an issue in next
Email us at [email protected]

🎯 Affected products1

npm/next:>= 12.0.0, < 12.0.9