CVE-2022-36046
published 2022-08-31CVE-2022-36046: Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js…
PriorityP425medium5.3CVSS 3.1
AVNACHPRLUINSUCNINAH
EPSS
0.96%
57.2th percentile
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| next | next | >= 12.2.3 < 12.2.4 | 12.2.4 |
| vercel | next.js | — | — |
| vercel | next.js | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Unexpected server crash in Next.js
ghsa·2022-08-30
CVE-2022-36046 [MEDIUM] CWE-248 Unexpected server crash in Next.js
Unexpected server crash in Next.js
### Impact
When specific requests are made to the Next.js server it can cause an `unhandledRejection` in the server which can crash the process to exit in specific Node.js versions with strict `unhandledRejection` handling.
- Affected: All of the following must be true to be affected by this CVE
- Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting
- Next.js version v12.2.3
- Using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server)
- Not affected: Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
### Patches
https://github.com/vercel/next.js/releases/tag/v12.2.4
OSV
Unexpected server crash in Next.js
osv·2022-08-30
CVE-2022-36046 [MEDIUM] Unexpected server crash in Next.js
Unexpected server crash in Next.js
### Impact
When specific requests are made to the Next.js server it can cause an `unhandledRejection` in the server which can crash the process to exit in specific Node.js versions with strict `unhandledRejection` handling.
- Affected: All of the following must be true to be affected by this CVE
- Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting
- Next.js version v12.2.3
- Using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server)
- Not affected: Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
### Patches
https://github.com/vercel/next.js/releases/tag/v12.2.4
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-08-31
Published