CVE-2022-36046: Improper Check for Unusual or Exceptional Conditions

August 31, 2022 (updated September 7, 2022)

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict unhandledRejection exiting AND using next start or a custom server. Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn’t being shared across requests.

References

github.com/advisories/GHSA-wff4-fpwg-qqv3
github.com/vercel/next.js/releases/tag/v12.2.4
github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3
nvd.nist.gov/vuln/detail/CVE-2022-36046

Code Behaviors & Features

Detect and mitigate CVE-2022-36046 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →