next

This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9

Vulnerable code could allow a bad actor to trigger a denial of service attack via the /${locale}/_next/ route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.

How to Upgrade

• We have released patch versions for both the stable and canary channels of Next.js.
• To upgrade run npm install next@latest --save

Impact

• Affected: All of the following must be true to be affected by this CVE
  • Next.js versions between v12.0.0 and v12.0.9
  • Using next start or a custom server
  • Using the built-in i18n support
• Not affected:
  • Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

How to Assess Impact

If your server has seen requests to any route under the prefix /${locale}/_next/ that have triggered a heap overflow error, this was caused by the patched issue.

What is Being Done

As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.

We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.

Regression tests for this attack were added to the i18n integration test suite

• A public CVE was released.
• We encourage responsible disclosure of future reports. Please email us at security@vercel.com. We are actively monitoring this mailbox.

Core Changes

• middlewares: limit process.env to inferred usage: #33186
• update webpack: #33207
• Abstract out native filesystem usage from the base server: #33226
• use text data url instead of base64 for shorter encoding: #33218
• chore(deps): upgrade postcss: #33142
• Fix global process testing for the process polyfill: #33220
• Update swc: #33201
• improve full refresh overlay: #33301
• Custom app for server components: #33149
• Update yarn PnP tests and disable swc file reading for PnP: #33236
• Base Http for BaseServer: #32999
• Update swc: #33342
• Update check for fallback pages during export: #33323
• Pre-compile more dependencies: #32742
• Remove node fetch polyfill from base server: #33395
• Replace regexp to plain string for optimization render HTML: #33306
• Fix broken html on streaming render for error page: #33399
• Disable cache for rsc pages: #33438
• Fix pre-compiled check from copying react-refresh-utils:

Documentation Changes

• Fixed broken link related to the recently merged Data fetching docs refactor: #33209
• Removed backticks on data fetching api titles: #33216
• Added links to data fetching api refs, fixed title: #33221
• Remove outdated & possibly confusing statement about redirects: #33224
• [examples] Add a statically generated blog example using Next.js and Builder.io: #22094
• Typo Fix: #33252
• Update font-optimization.md: #33266
• Fixed broken links in data fetching docs: #33250
• docs: Mention middleware for getStaticProps: #33273
• Add sections for Remove React Properties and Remove Console to compiler docs: #33311
• Update links in next export + next/image error message: #33317
• Add onLoad gottcha note to next/script docs: #33097
• Update security-headers.md: fix path does not match homepage: #33137
• fix minor typo in SWR: #33378
• ReferenceError in authentication.md example fixed: #33411
• docs: fix url: #33409
• fix(docs): Fix typo in Custom Build Id docs: #33515
• [docs] Update authentication docs to fix iron-session link.:

Example Changes

• [examples] Update remark dependency for blog-starter: #33313
• Update package.json for examples/with-supabase-auth-realtime-db: #33321
• Working example for building forms with Next.js: #32669
• Updates dependency version of frontend SDK in with-supertokens example: #33393
• docs: add skynexui to examples: #33326
• Update with-linaria dependency: #33487
• Update Supabase example README.: #33610
• [examples] Add new Tailwind CSS Prettier plugin to example: #33614

Misc Changes

• Update license year
• fix(docs): master branch renaming: #33312
• Add link to security email directly.: #33358
• Fix getServerSideProps hanging in dev on early end: #33366
• [docs] Fix 404 link for testing example.: #33407
• Update to latest version of turbo: #33613
• Update other instances of node-fetch: #33617

Credits

Huge thanks to @molebox, @Schniz, @sokra, @kachkaev, @shuding, @teleaziz, @OgbeniHMMD, @goncy, @balazsorban44, @MaedahBatool, @bennettdams, @kdy1, @huozhi, @hsynlms, @styfle, @ijjk, @callumgare, @jonrosner, @karaggeorge, @rpie3, @MartijnHols, @leerob, @bashunaimiroy, @NOCELL, @rishabhpoddar, @omariosouto, @hanneslund, @theMosaad, @javivelasco, @pierrenel, @lobsterkatie, @tharakabimal, @vvo, @saevarb, @lfades, @nbouvrette, @paulnbrd, @ecklf, @11koukou, @renbaoshuo, @chozzz, @tbezman, @karlhorky, @j-mendez, and @ffan0811 for helping!