Executive brief
A vulnerability in the Next.js web framework can allow an attacker to crash a web server by sending a specially crafted, malformed URL. This results in a denial-of-service condition, making the website or application unavailable to legitimate users. The issue primarily affects self-hosted deployments using specific versions of Node.js and Next.js, while those hosted on Vercel's managed platform are generally protected by existing request filtering.
Technical details
A vulnerability in Next.js versions between 11.1.0 and 12.0.5 (excluding patched releases) allows for a remote denial-of-service (DoS). The root cause is improper input validation (CWE-20) where malformed or invalid URLs trigger an unhandled promise rejection in the request handling logic. When running on Node.js versions above 15.0.0, these unhandled rejections cause the Node.js process to terminate (crash). The vulnerability is exploitable via unauthenticated network requests. It specifically affects deployments using 'next start' or a custom server where invalid requests are not filtered by a reverse proxy or WAF before reaching the application. Patches are available in versions 11.1.3 and 12.0.5.
Affected products
- Vercel Next.js >= 11.1.0, < 11.1.3; >= 12.0.0, < 12.0.5
Timeline
- 2021-12-03: patched: Fix merged into canary branch via PR 32080 and 32092.
- 2021-12-07: disclosed: Security advisory published.
References
- https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx
- https://github.com/vercel/next.js/pull/32080
- https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264
- https://github.com/vercel/next.js
- https://github.com/vercel/next.js/releases/tag/v11.1.3
- https://github.com/vercel/next.js/releases/v12.0.5