Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2022-21721

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 80.1%
CVSS Severity
CVSS v3 Score 5.9
CVSS v2 Score 4.3
Products affected by CVE-2022-21721
  • Vercel » Next.js » Version: 12.0.0
    cpe:2.3:a:vercel:next.js:12.0.0
  • Vercel » Next.js » Version: 12.0.1
    cpe:2.3:a:vercel:next.js:12.0.1
  • Vercel » Next.js » Version: 12.0.2
    cpe:2.3:a:vercel:next.js:12.0.2
  • Vercel » Next.js » Version: 12.0.3
    cpe:2.3:a:vercel:next.js:12.0.3
  • Vercel » Next.js » Version: 12.0.4
    cpe:2.3:a:vercel:next.js:12.0.4
  • Vercel » Next.js » Version: 12.0.5
    cpe:2.3:a:vercel:next.js:12.0.5
  • Vercel » Next.js » Version: 12.0.6
    cpe:2.3:a:vercel:next.js:12.0.6
  • Vercel » Next.js » Version: 12.0.7
    cpe:2.3:a:vercel:next.js:12.0.7
  • Vercel » Next.js » Version: 12.0.8
    cpe:2.3:a:vercel:next.js:12.0.8


Products
Pricing
Contact Us

Shodan ® - All rights reserved