CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21721 – DOS Vulnerability in next.js
https://notcve.org/view.php?id=CVE-2022-21721
Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. • https://github.com/vercel/next.js/pull/33503 https://github.com/vercel/next.js/releases/tag/v12.0.9 https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5x •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-43803 – Unexpected server crash in Next.js
https://notcve.org/view.php?id=CVE-2021-43803
Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. • https://github.com/vercel/next.js/commit/6d98b4fb4315dec1badecf0e9bdc212a4272b264 https://github.com/vercel/next.js/pull/32080 https://github.com/vercel/next.js/releases/tag/v11.1.3 https://github.com/vercel/next.js/releases/v12.0.5 https://github.com/vercel/next.js/security/advisories/GHSA-25mp-g6fv-mqxx • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-39178 – XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0
https://notcve.org/view.php?id=CVE-2021-39178
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default or the instance is deployed on Vercel, the instance is not affected by the vulnerability. The vulnerability is patched in Next.js version 11.1.1. • https://github.com/vercel/next.js/releases/tag/v11.1.1 https://github.com/vercel/next.js/security/advisories/GHSA-9gr3-7897-pp7m • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.9EPSS: 0%CPEs: 2EXPL: 0CVE-2021-37699 – Open Redirect in Next.js versions below 11.1.0
https://notcve.org/view.php?id=CVE-2021-37699
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0. • https://github.com/vercel/next.js/releases/tag/v11.1.0 https://github.com/vercel/next.js/security/advisories/GHSA-vxf5-wxwp-m7g9 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15242 – Open Redirect in Next.js
https://notcve.org/view.php?id=CVE-2020-15242
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4. Next.js versiones de posteriores e incluyendo a 9.5.0 y anteriores a 9.5.4, son vulnerables a un redireccionamiento abierto. • https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435 https://github.com/zeit/next.js/releases/tag/v9.5.4 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •