Next.js Denial-of-Service Vulnerability via Invalid URL Processing

A denial-of-service vulnerability has been identified in Next.js, a React framework, affecting versions prior to 12.0.5 and 11.1.3. When deployments using Node.js versions above 15.0.0 receive invalid or malformed URLs, it can lead to a server crash. This issue arises because the server fails to properly handle the invalid URLs, causing an unhandled promise rejection that terminates the server process. The vulnerability is not present in environments like Vercel, where such invalid requests are filtered out before reaching the Next.js application.

Impact

Exploiting this vulnerability can cause the Next.js server process to crash, leading to an unexpected downtime of the application.

Reproduction

To reproduce this vulnerability, deploy a Next.js application on a server using Node.js versions greater than 15.0.0. Ensure that the application is running Next.js versions above 11.1.0 and below 12.0.5, and that it is not on Vercel or a similar environment that filters invalid requests. Once the application is running, send a request with an invalid URL. The server should respond with a status code of 400, but instead, it will crash.

Remediation

Upgrade Next.js to version 12.0.5 or 11.1.3, both of which include patches for this vulnerability.