CVE-2022-36046 Details
Description
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.
A denial-of-service vulnerability has been identified in Next.js version 12.2.3. When running on Node.js versions above 15.0.0 with strict 'unhandledRejection' exiting, the server can crash due to an unhandled promise rejection. This issue occurs specifically when 'next start' or a custom server is used, and it is not present in Vercel deployments or similar environments where 'next-server' is not shared across requests.
Users can upgrade to Next.js version 12.2.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vercel/next.js/releases/tag/v12.2.4 | CVE | Release NotesThird Party Advisory |
| https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3 | CVE | Third Party Advisory |
| https://github.com/vercel/next.js/releases/tag/v12.2.4 | [email protected] | Release NotesThird Party Advisory |
| https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vercel next.js | 12.2.3 |
CPE
Remediation
| |
| nodejs node.js | >= 15.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Sep 7, 2022 | Initial Analysis | [email protected] |