CVE-2024-34350: Next.js Vulnerable to HTTP Request Smuggling

May 9, 2024

Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.

For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.

References

github.com/advisories/GHSA-77r5-gw3j-2mpf
github.com/vercel/next.js
github.com/vercel/next.js/commit/44eba020c615f0d9efe431f84ada67b81576f3f5
github.com/vercel/next.js/compare/v13.5.0...v13.5.1
github.com/vercel/next.js/security/advisories/GHSA-77r5-gw3j-2mpf
nvd.nist.gov/vuln/detail/CVE-2024-34350

Code Behaviors & Features

Detect and mitigate CVE-2024-34350 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →