Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs
    could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js
    versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server.
    Deployments on Vercel are not affected, along with similar environments where invalid requests are
    filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
    (CVE-2021-43803)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs
    could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js
    versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server.
    Deployments on Vercel are not affected, along with similar environments where invalid requests are
    filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue.
    (CVE-2021-43803)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an
    insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check
    if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows
    platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows
    machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever
    the above conditions are present, `node.exe` will search for `providers.dll` in the current user
    directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in
    Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of
    paths and exploit this vulnerability. (CVE-2022-32223)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
    can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

ID	Name	Product	Family	Severity
408709	SCA: security update for next (GHSA-25mp-g6fv-mqxx)	Tenable Cloud Security	SCA Checks	high
408709	SCA: security update for next (GHSA-25mp-g6fv-mqxx)	Tenable Self-Hosted Container Security	SCA Checks	high
405783	Alpine: nodejs: security update to 0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
405783	Alpine: nodejs: security update to 0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2021-43803

high

Tenable Plugins

high

high

critical

critical