Last week we announced that Next.js would be moving to a preannounced security release model, with patches announced ahead of time so that teams can plan for them.
Updates are now available in v16.2.11 (Active LTS) and v15.5.21 (Maintenance LTS) to address these issues Please patch your Next.js dependencies to maintain the security of your applications.
These fixes will also be included in v16.3.0 when it reaches a stable release.
Impact
Denial of Service in App Router using Server Actions (High Severity)
Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage. The CPU usage blocks processing of further requests in the same process, leading to Denial of Service.
Middleware / Proxy bypass in App Router applications using Turbopack and single locale (High Severity)
Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales are vulnerable to a middleware/proxy bypass. Accordingly, any authentication or security checks that a middleware/proxy may perform are bypassed.
Server-Side Request Forgery in rewrites via attacker-controlled destination hostname (High Severity)
A rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For rewrites, this behavior enables to Server-Side Request Forgery (SSRF); for redirects, Open Redirect can be achieved.
Server-Side Request Forgery in Server Actions on custom servers (High Severity)
When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker’s request to control Host-associated headers.
Denial of Service in the Image Optimization API using SVGs (Medium Severity)
When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, the images can cause CPU exhaustion in the /_next/image endpoint.
Unbounded Server Action payload in Edge runtime (Medium Severity)
A crafted request can lead to memory consumption on Server Actions in the Edge runtime. Next.js applications which use App Router and have at least one Server Action are affected.
Unauthenticated disclosure of internal Server Function endpoints (Medium Severity)
In Next.js applications using App Router, Server Actions (use server) or use cache endpoint IDs can be globally disclosed. An attacker can use this for reconnaissance and as part of a broader attack chain.
Cache confusion of response bodies for requests with bodies (Medium Severity)
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies for fetch calls of the following shape:
Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences (Medium Severity)
A server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This only applies when receiving request bodies which contain invalid UTF-8 characters. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache.
Our security program
We work with a talented set of researchers to secure Next.js and other open source frameworks through Vercel's Open Source Bug Bounty. Anyone interested in contributing to the security of eligible frameworks is encouraged to participate there.
Any questions or concerns regarding our security programs or vulnerability management can be sent to security@vercel.com.