CVE-2022-21721: Denial of Service Vulnerability in next.js
Summary
CVE-2022-21721: Denial of Service Vulnerability in next.js. Affects next versions >= 12.0.0, < 12.0.9. Fixed in 12.0.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Next.js is a popular open-source framework for building server-side rendered React applications. It provides a range of features and tools to simplify the development process, including built-in i18n support for internationalization. However, Next.js versions 12.0.0 and above are vulnerable to a denial of service attack when using the i18n functionality.
Vulnerability Detail
The vulnerability allows a malicious actor to trigger a denial of service attack on Next.js apps running version 12.0.0 or higher and using i18n functionality. This can impact anyone using Next.js with a custom server or using the 'next start' command. Deployments on Vercel or similar environments where invalid requests are filtered before reaching Next.js are not affected. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
How To Fix
Latest published version: 16.4.2 as of 22 Oct 2026
npm install next@16.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.9
This is the first release that contains the fix.
npm install next@12.0.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to block requests to the '/${locale}/_next/' path from reaching the Next.js instance until the upgrade can be performed. This can be achieved through server configuration or middleware. However, it is important to note that this is not a permanent solution and upgrading is still necessary.
Conclusion
In conclusion, Next.js versions 12.0.0 and above are vulnerable to a denial of service attack when using the i18n functionality. It is crucial to upgrade to version 12.0.9 or higher to mitigate this vulnerability. Blocking requests to the '/${locale}/_next/' path can serve as a temporary workaround until the upgrade is completed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for next →
FAQ
Next.js versions 12.0.0 and above are affected by this vulnerability.
The vulnerability allows for a denial of service attack, potentially impacting the availability of Next.js apps using the i18n functionality.
No, deployments on Vercel or similar environments where invalid requests are filtered before reaching Next.js are not affected by this vulnerability.
The recommended solution is to upgrade to the latest version of Next.js (12.0.9 or higher) that includes a patch to mitigate the vulnerability.
Yes, a temporary workaround is to block requests to the '/${locale}/_next/' path from reaching the Next.js instance until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for next.
