Executive brief
Next.js is a popular web framework for building server-rendered JavaScript applications. Self-hosted Next.js applications using the built-in internationalization (i18n) feature are vulnerable to denial of service attacks, where attackers can craft malicious requests to crash or severely degrade the application's availability. Deployments on Vercel's managed hosting are not affected.
Technical details
The vulnerability is an improper input validation issue (CWE-20, CWE-400) affecting Next.js versions 12.0.0 through 12.0.8. The flaw exists in the i18n routing handler, where requests to paths matching the pattern /${locale}/_next/ are not properly validated, allowing attackers to trigger a denial of service condition. The vulnerability only affects self-hosted deployments using `next start` or a custom server with i18n enabled; Vercel-hosted applications are unaffected due to request filtering at the platform level. The attack requires only network access and no authentication. A patch is available in Next.js 12.0.9 and later.
Affected products
- Vercel Next.js 12.0.0 to 12.0.8
Timeline
- 2022-01-28: disclosed
- 2022-01-28: patched: Patch released in Next.js 12.0.9