PT-2022-23140 · Next.Js+1 · Next.Js+1

Ijjk · Published 2022-08-30 · Updated 2022-09-07 · CVE-2022-36046

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js version 12.2.3

Description The issue affects Next.js when used with Node.js version above v15.0.0 and strict unhandledRejection exiting, and when using next start or a custom server. Specific requests to the Next.js server can cause an unhandledRejection in the server, leading to a process crash. Deployments on Vercel and similar environments where next-server isn't shared across requests are not affected.

Recommendations For Next.js version 12.2.3, update to version 12.2.4 or later to resolve the issue. As a temporary workaround, consider disabling the use of next start or custom servers until the update is applied. Restrict access to the custom server to minimize the risk of exploitation. Avoid using Node.js versions above v15.0.0 with strict unhandledRejection exiting until the issue is resolved.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

CWE-248

Related Identifiers

CVE-2022-36046

GHSA-WFF4-FPWG-QQV3

Affected Products

Next.Js

Node.Js

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36046.json · Exploit
• https://osv.dev/vulnerability/GHSA-wff4-fpwg-qqv3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36046 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36046 · Security Note
• https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3 · Note
• https://github.com/vercel/next.js/releases/tag/v12.2.4 · Note
• https://t.me/cvenotify/35529 · Telegram Post
• https://t.me/cvenotify/35538 · Telegram Post
• https://t.me/cibsecurity/49142 · Telegram Post