Additional changes to review1 matched termMatched wording:removedThese matches may be harmless in context. Expand to see the excerpts.
This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9
Vulnerable code could allow a bad actor to trigger a denial of service attack via the /${locale}/_next/ route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.
How to Upgrade
- We have released patch versions for both the stable and canary channels of Next.js.
- To upgrade run
npm install next@latest --save
Impact
- Affected: All of the following must be true to be affected by this CVE
- Next.js versions between
v12.0.0andv12.0.9 - Using next start or a custom server
- Using the built-in i18n support
- Next.js versions between
- Not affected:
- Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.
We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.
How to Assess Impact
If your server has seen requests to any route under the prefix /${locale}/_next/ that have triggered a heap overflow error, this was caused by the patched issue.