CVE-2022-21721: Uncontrolled Resource Consumption

January 28, 2022 (updated July 24, 2023)

Next. one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, next@12.0.9, that mitigates this issue. As a workaround, one may ensure /${locale}/_next/ is blocked from reaching the Next.js instance until it becomes feasible to upgrade.

References

github.com/vercel/next.js/pull/33503
github.com/vercel/next.js/releases/tag/v12.0.9
github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x
nvd.nist.gov/vuln/detail/CVE-2022-21721

Code Behaviors & Features

Detect and mitigate CVE-2022-21721 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →