Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency next to v12.0.9 [SECURITY] #168

Merged
merged 1 commit into from
Jan 29, 2022

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jan 29, 2022

WhiteSource Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
next (source) 12.0.8 -> 12.0.9 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-21721

Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

  • Affected: All of the following must be true to be affected by this CVE
    • Next.js versions above v12.0.0
    • Using next start or a custom server
    • Using the built-in i18n support
  • Not affected:
    • Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

Patches

A patch has been released, next@12.0.9, that mitigates this issue. We recommend all affected users upgrade as soon as possible.

Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure /${locale}/_next/ is blocked from reaching the Next.js instance until you upgrade.

For more information

If you have any questions or comments about this advisory:


Release Notes

vercel/next.js

v12.0.9

Compare Source

This upgrade is completely backward-compatible and recommended for all users on versions below 12.0.9

Vulnerable code could allow a bad actor to trigger a denial of service attack via the /${locale}/_next/ route for anyone running a Next.js app at version >= 12.0.0, and using built-in i18n routing functionality.

How to Upgrade
  • We have released patch versions for both the stable and canary channels of Next.js.
  • To upgrade run npm install next@latest --save
Impact
  • Affected: All of the following must be true to be affected by this CVE
    • Next.js versions between v12.0.0 and v12.0.9
    • Using next start or a custom server
    • Using the built-in i18n support
  • Not affected:
    • Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

How to Assess Impact

If your server has seen requests to any route under the prefix /${locale}/_next/ that have triggered a heap overflow error, this was caused by the patched issue.

What is Being Done

As Next.js has grown in popularity and usage by enterprises, it has received the attention of security researchers and auditors. We are thankful to our users for their investigation and responsible disclosure of the original bug.

We've landed a patch that ensures this is handled properly so the requested route no longer crashes and triggers a heap overflow.

Regression tests for this attack were added to the i18n integration test suite

  • A public CVE was released.
  • We encourage responsible disclosure of future reports. Please email us at security@vercel.com. We are actively monitoring this mailbox.
Core Changes
  • middlewares: limit process.env to inferred usage: #​33186
  • update webpack: #​33207
  • Abstract out native filesystem usage from the base server: #​33226
  • use text data url instead of base64 for shorter encoding: #​33218
  • chore(deps): upgrade postcss: #​33142
  • Fix global process testing for the process polyfill: #​33220
  • Update swc: #​33201
  • improve full refresh overlay: #​33301
  • Custom app for server components: #​33149
  • Update yarn PnP tests and disable swc file reading for PnP: #​33236
  • Base Http for BaseServer: #​32999
  • Update swc: #​33342
  • Update check for fallback pages during export: #​33323
  • Pre-compile more dependencies: #​32742
  • Remove node fetch polyfill from base server: #​33395
  • Replace regexp to plain string for optimization render HTML: #​33306
  • Fix broken html on streaming render for error page: #​33399
  • Disable cache for rsc pages: #​33438
  • Fix pre-compiled check from copying react-refresh-utils: #​33442
  • fix(next-swc): Update swc: #​33427
  • Move middleware handling to node server: #​33448
  • Enforce absolute URLs in Edge Functions runtime: #​33410
  • feat(next-swc): Update swc: #​33461
  • Update main field for nccd jest-worker: #​33465
  • chore(deps): upgrade node-fetch: #​33466
  • Move static serving to next server: #​33475
  • feat(next-swc): Update swc: #​33485
  • Fix multiple calls to image onLoadingComplete(): #​33474
  • Refactor base server to remove native dependencies: #​33499
  • Update swc: #​33514
  • Implement abstract methods to get manifest files in the base server: #​33537
  • Simplify getMiddlewareInfo calls: #​33542
  • Fix static file check with i18n: #​33503
  • Bump styled-jsx: #​33546
  • Ensure optional value normalizing is correct for index: #​33547
  • Bump nft to 0.17.4: #​33548
  • Add next-multilingual example: #​29386
  • Removed the s from NextConfig: #​33560
  • feat(next-swc): Update swc: #​33595
  • Fix rsc export component name detection: #​33608
  • upgrade webpack: #​33549
  • Ensure fetch polyfill is loaded in next-server: #​33616
  • feat(next-swc): Update swc: #​33628
  • Add lazyRoot optional property to next/image component : #​33290
  • feat(next-swc): Update swc: #​33675
  • Implement web server as the request handler for edge SSR: #​33635
  • Relay Support in Rust Compiler: #​33240
  • Revert "Relay Support in Rust Compiler": #​33699
Documentation Changes
  • Fixed broken link related to the recently merged Data fetching docs refactor: #​33209
  • Removed backticks on data fetching api titles: #​33216
  • Added links to data fetching api refs, fixed title: #​33221
  • Remove outdated & possibly confusing statement about redirects: #​33224
  • [examples] Add a statically generated blog example using Next.js and Builder.io: #​22094
  • Typo Fix: #​33252
  • Update font-optimization.md: #​33266
  • Fixed broken links in data fetching docs: #​33250
  • docs: Mention middleware for getStaticProps: #​33273
  • Add sections for Remove React Properties and Remove Console to compiler docs: #​33311
  • Update links in next export + next/image error message: #​33317
  • Add onLoad gottcha note to next/script docs: #​33097
  • Update security-headers.md: fix path does not match homepage: #​33137
  • fix minor typo in SWR: #​33378
  • ReferenceError in authentication.md example fixed: #​33411
  • docs: fix url: #​33409
  • fix(docs): Fix typo in Custom Build Id docs: #​33515
  • [docs] Update authentication docs to fix iron-session link.: #​33483
  • docs(authentication): fix iron-session example link: #​33502
  • Update middleware documentation for custom server: #​33535
  • Removed unrequired path in docs' manifest: #​33579
  • Update next/server documentation for geo: #​33609
  • Clarify next/image usage with next export based on feedback.: #​33555
  • Clarify headers config option description: #​33484
  • fix(errors/no-cache): netlify-plugin-cache-nextjs has been deprecated: #​33629
  • Updated docs for getServerSideProps and getStaticProps return values: #​33577
  • Use relative path for example: #​33565
  • chore(docs): update security headers specification: #​33673
  • REMOVE: duplicate key in docs/testing.md: #​33681
Example Changes
  • [examples] Update remark dependency for blog-starter: #​33313
  • Update package.json for examples/with-supabase-auth-realtime-db: #​33321
  • Working example for building forms with Next.js: #​32669
  • Updates dependency version of frontend SDK in with-supertokens example: #​33393
  • docs: add skynexui to examples: #​33326
  • Update with-linaria dependency: #​33487
  • Update Supabase example README.: #​33610
  • [examples] Add new Tailwind CSS Prettier plugin to example: #​33614
Misc Changes
  • Update license year
  • fix(docs): master branch renaming: #​33312
  • Add link to security email directly.: #​33358
  • Fix getServerSideProps hanging in dev on early end: #​33366
  • [docs] Fix 404 link for testing example.: #​33407
  • Update to latest version of turbo: #​33613
  • Update other instances of node-fetch: #​33617
Credits

Huge thanks to @​molebox, @​Schniz, @​sokra, @​kachkaev, @​shuding, @​teleaziz, @​OgbeniHMMD, @​goncy, @​balazsorban44, @​MaedahBatool, @​bennettdams, @​kdy1, @​huozhi, @​hsynlms, @​styfle, @​ijjk, @​callumgare, @​jonrosner, @​karaggeorge, @​rpie3, @​MartijnHols, @​leerob, @​bashunaimiroy, @​NOCELL, @​rishabhpoddar, @​omariosouto, @​hanneslund, @​theMosaad, @​javivelasco, @​pierrenel, @​lobsterkatie, @​tharakabimal, @​vvo, @​saevarb, @​lfades, @​nbouvrette, @​paulnbrd, @​ecklf, @​11koukou, @​renbaoshuo, @​chozzz, @​tbezman, @​karlhorky, @​j-mendez, and @​ffan0811 for helping!


Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, click this checkbox.

This PR has been generated by WhiteSource Renovate. View repository job log here.

@onigoetz onigoetz merged commit 2efd82a into master Jan 29, 2022
@renovate renovate bot deleted the renovate/npm-next-vulnerability branch January 29, 2022 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants