要点
- CVE-2022-36046 是影响 nextjs, next.js (vercel), next 的中危 (CVSS 5.3)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.2%，高于 67.8% 的漏洞。
- 修复：升级到 12.2.4 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| nextjs PyPI | ≤ 12.2.3
| No fix yet |
| next.js | = 12.2.3
| No fix yet |
| next npm | ≥ 12.2.3, < 12.2.4
| 12.2.4
|
Description
Impact
When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling.
-
Affected: All of the following must be true to be affected by this CVE
- Node.js version above v15.0.0 being used with strict
unhandledRejection exiting
- Next.js version v12.2.3
- Using next start or a custom server
-
Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests.
Patches
https://github.com/vercel/next.js/releases/tag/v12.2.4
NVD description
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free