CVE-2022-21721

Katalog CVE

CVSS 7.5 · High EPSS 2,2%

Kerentanan pada vercel next.js. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.

Rincian

Terbit di NVD

28 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 81,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vercel/next.js/pull/33503 patch · advisory pihak ketiga
• https://github.com/vercel/next.js/releases/tag/v12.0.9 release notes · advisory pihak ketiga
• https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x advisory pihak ketiga