TI-2022-06094 Aliases CVE-2022-21721 GHSA-wr66-vrwm-5g5x

DOS Vulnerability in next.js

LOW 37CWE-20Published 2022-01-28 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `[email protected]`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.02153 82nd percentileScored 2026-11-07

Fix Fixed next (npm): 12.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	next (npm)	12.0.0 to before 12.0.9	12.0.9	Patch available	GHSA-wr66-vrwm-5g5x

— Vendor— Affected all versions Fixed in — No fix listed CNA
next (npm) Vendor— Affected 12.0.0 to before 12.0.9 Fixed in 12.0.9 Patch available GHSA-wr66-vrwm-5g5x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vercel:next.js::::::node.js::*	12.0.0 to before 12.0.9	Vulnerable	vercel

cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:* Versions 12.0.0 to before 12.0.9 Vulnerable ·vercel

Remediation

Fix · GHSA-wr66-vrwm-5g5x next (npm) Fixed in 12.0.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-21721
2026-10-03 Alias added: GHSA-wr66-vrwm-5g5x

References

Patch 1

https://github.com/vercel/next.js/pull/33503

Advisory 3

Other 1

https://github.com/vercel/next.js

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2025-21309 Authorization Bypass in Next.js Middleware CVSS 3.1CRITICAL 9.1
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
TI-2024-31371 Cache Poisoning in next.js CVSS 3.1HIGH 7.5
TI-2023-24914 Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch… CVSS 3.1HIGH 7.5
TI-2026-32490 Next.js: Server-side request forgery in applications using WebSocket upgrades CVSS 3.1HIGH 8.6

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences