Next.js Denial-of-Service Vulnerability in i18n Functionality

A denial-of-service vulnerability has been identified in Next.js, a React framework, affecting versions 12.0.0 prior to 12.0.9. The issue arises for users employing the built-in internationalization (i18n) support, and who are running their applications with 'next start' or a custom server. In these cases, a malicious actor could exploit the vulnerability by sending requests that trigger a heap overflow error, causing the application to crash. Notably, deployments on Vercel or similar environments that filter invalid requests before they reach Next.js are not affected.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, where the Next.js application crashes and becomes unresponsive.

Remediation

Users can upgrade to Next.js version 12.0.9, which addresses this vulnerability. For those unable to upgrade immediately, it is recommended to block the 'next' static files under the i18n locale prefix from reaching the Next.js instance until an upgrade can be performed.