🚨 [security] Update next 12.0.5 → 14.2.15 (major) #114

depfu · 2024-10-23T15:32:16Z

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ next (12.0.5 → 14.2.15) · Repo

Security Advisories 🚨

🚨 Denial of Service condition in Next.js image optimization

Impact

The image optimization feature of Next.js contained a vulnerability which allowed for a potential Denial of Service (DoS) condition which could lead to excessive CPU consumption.

Not affected:

The next.config.js file is configured with images.unoptimized set to true or images.loader set to a non-default value.

The Next.js application is hosted on Vercel.

Patches

This issue was fully patched in Next.js 14.2.7. We recommend that users upgrade to at least this version.

Workarounds

Ensure that the next.config.js file has either images.unoptimized, images.loader or images.loaderFile assigned.

Credits

Brandon Dahler (brandondahler), AWS
Dimitrios Vlastaras

🚨 Next.js Cache Poisoning

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

Next.js between 13.5.1 and 14.2.9

Using pages router

Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

Deployments using only app router

Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

Allam Rachid (zhero_)

Henry Chen

🚨 Next.js Cache Poisoning

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

Next.js between 13.5.1 and 14.2.9

Using pages router

Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

Deployments using only app router

Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

Allam Rachid (zhero_)

Henry Chen

🚨 Next.js Denial of Service (DoS) condition

Impact

A Denial of Service (DoS) condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server.

This vulnerability can affect all Next.js deployments on the affected versions.

Patches

This vulnerability was resolved in Next.js 13.5 and later. We recommend that users upgrade to a safe version.

Workarounds

There are no official workarounds for this vulnerability.

Credit

We'd like to thank Thai Vu of flyseccorp.com for responsible disclosure of this vulnerability.

🚨 Next.js Vulnerable to HTTP Request Smuggling

Impact

Inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions.

For a request to be exploitable, the affected route also had to be making use of the rewrites feature in Next.js.

Patches

The vulnerability is resolved in Next.js 13.5.1 and newer. This includes Next.js 14.x.

Workarounds

There are no official workarounds for this vulnerability. We recommend that you upgrade to a safe version.

References

https://portswigger.net/web-security/request-smuggling/advanced/response-queue-poisoning

🚨 Next.js Server-Side Request Forgery in Server Actions

Impact

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself.

Prerequisites

Next.js (<14.1.1) is running in a self-hosted* manner.

The Next.js application makes use of Server Actions.

The Server Action performs a redirect to a relative path which starts with a /.

* Many hosting providers (including Vercel) route requests based on the Host header, so we do not believe that this vulnerability affects any Next.js applications where routing is done in this manner.

Patches

This vulnerability was patched in #62561 and fixed in Next.js 14.1.1.

Workarounds

There are no official workarounds for this vulnerability. We recommend upgrading to Next.js 14.1.1.

Credit

Vercel and the Next.js team thank Assetnote for responsibly disclosing this issue to us, and for working with us to verify the fix. Thanks to:

Adam Kues - Assetnote
Shubham Shah - Assetnote

🚨 Next.js missing cache-control header may lead to CDN caching empty reply

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

🚨 Unexpected server crash in Next.js

Impact

When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling.

Affected: All of the following must be true to be affected by this CVE

Node.js version above v15.0.0 being used with strict unhandledRejection exiting

Next.js version v12.2.3

Using next start or a custom server

Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests.

Patches

https://github.com/vercel/next.js/releases/tag/v12.2.4

🚨 Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Impact

Affected: All of the following must be true to be affected

Next.js between version 10.0.0 and 12.0.10

The next.config.js file has images.domains array assigned

The image host assigned in images.domains allows user-provided SVG

Not affected: The next.config.js file has images.loader assigned to something other than default

Patches

Next.js 12.1.0

Workarounds

Change next.config.js to use a different loader configuration other than the default, for example:
module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}
Or if you want to use the loader prop on the component, you can use custom:
module.exports = {
  images: {
    loader: 'custom',
  },
}

🚨 Denial of Service Vulnerability in next.js

Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

Affected: All of the following must be true to be affected by this CVE

Next.js versions above v12.0.0

Using next start or a custom server

Using the built-in i18n support

Not affected:

Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

Patches

A patch has been released, [email protected], that mitigates this issue. We recommend all affected users upgrade as soon as possible.

Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/_next/ is blocked from reaching the Next.js instance until you upgrade.

For more information

If you have any questions or comments about this advisory:

Open an issue in next

Email us at [email protected]

Release Notes

Too many releases to show here. View the full release notes.

Sorry, we couldn't find anything useful about this release.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

changeset-bot · 2024-10-23T15:32:21Z

⚠️ No Changeset found

Latest commit: 64e67d6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2024-10-23T15:32:51Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@babel/[email protected]	None	`0`	153 kB	nicolo-ribaudo
npm/@next/[email protected]	environment, filesystem	`0`	11.7 kB	matt.straka, rauchg, timer, ...2 more
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	131 MB	vercel-release-bot
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	0 B
npm/@next/[email protected]	None	`0`	94 MB	vercel-release-bot
npm/@next/[email protected]	None	`0`	136 MB	vercel-release-bot
npm/@swc/[email protected]	None	`0`	1.18 kB	kdy1
npm/@swc/[email protected]	None	`0`	230 kB	kdy1
npm/[email protected]	None	`0`	82.5 kB	feross
npm/[email protected]	None	`0`	124 kB	mscdex
npm/[email protected]	None	`0`	2.11 MB	ai, beneb, caniuse-lite
npm/[email protected]	environment, filesystem	`+1`	99 kB	paulmillr
npm/[email protected]	None	`0`	611 B	sebmarkbage
npm/[email protected]	None	`0`	27.2 kB	qix
npm/[email protected]	None	`0`	81.9 kB	kilianvalkhof
npm/[email protected]	None	`0`	3.79 kB	sindresorhus
npm/[email protected]	environment, filesystem	`0`	32.5 kB	isaacs
npm/[email protected]	None	`0`	242 kB	jordanbtucker
npm/[email protected]	None	`0`	24.4 kB	ai
npm/[email protected]	environment, filesystem, network, shell, unsafe	`0`	86.3 MB	vercel-release-bot
npm/[email protected]	None	`0`	23.1 kB	chicoxyzzy
npm/[email protected]	environment, filesystem	`0`	197 kB	ai
npm/[email protected]	None	`0`	140 kB	7rulnik
npm/[email protected]	None	`0`	16.6 kB	mscdex
npm/[email protected]	environment	`0`	1.03 MB	vercel-release-bot
npm/[email protected]	None	`0`	268 kB	sebmaster
npm/[email protected]	None	`0`	89.1 kB	typescript-bot
npm/[email protected]	None	`0`	12.4 kB	sebmaster
npm/[email protected]	None	`0`	49.9 kB	domenic

View full report↗︎

Update all of nextjs to version 14.2.15

64e67d6

depfu bot added the depfu label Oct 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update next 12.0.5 → 14.2.15 (major) #114

🚨 [security] Update next 12.0.5 → 14.2.15 (major) #114

depfu bot commented Oct 23, 2024

changeset-bot bot commented Oct 23, 2024

socket-security bot commented Oct 23, 2024

🚨 [security] Update next 12.0.5 → 14.2.15 (major) #114

Are you sure you want to change the base?

🚨 [security] Update next 12.0.5 → 14.2.15 (major) #114

Conversation

depfu bot commented Oct 23, 2024

What changed?

✳️ next (12.0.5 → 14.2.15) · Repo

Impact

Patches

Workarounds

Credits

Impact

Patches

Workarounds

Credits

Impact

Patches

Workarounds

Credits

Impact

Patches

Workarounds

Credit

Impact

Patches

Workarounds

References

Impact

Prerequisites

Patches

Workarounds

Credit

Impact

Patches

Impact

Patches

Workarounds

Impact

Patches

Workarounds

For more information

changeset-bot bot commented Oct 23, 2024

⚠️ No Changeset found

socket-security bot commented Oct 23, 2024