GHSA-wff4-fpwg-qqv3 CVE-2022-36046 PYSEC-2022-43188

Unexpected server crash in Next.js

Medium PyPInpm

Severity: 5.3 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 1.19%; Chance of exploitation in the next 30 days. Higher than 67.84% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-248 Uncaught Exception; CWE-754 Improper Check for Unusual or Exceptional Conditions
Fix: 12.2.4; Upgrade next to this version or later

Description

Impact

When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling.

Affected: All of the following must be true to be affected by this CVE
- Node.js version above v15.0.0 being used with strict unhandledRejection exiting
- Next.js version v12.2.3
- Using next start or a custom server
Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests.

Patches

https://github.com/vercel/next.js/releases/tag/v12.2.4

Affected versions

PyPI

Package	Vulnerable	Fixed in
nextjs	`<= 12.2.3`	No fix yet

npm

Package	Vulnerable	Fixed in
next	`>= 12.2.3, < 12.2.4`	`12.2.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

next npm → `12.2.4`

npm

npm install next@12.2.4

yarn

yarn add next@12.2.4

pnpm

pnpm add next@12.2.4

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: High
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-248: Uncaught Exception

An exception is thrown from a function, but it is not caught.

CWE-754: Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

How to prevent it

Requirements: Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Choose languages with features such as exception handling that force the programmer to anticipate unusual conditions that may generate exceptions. Custom exceptions may need to be developed to handle unusual business-logic conditions. Be careful not to pass sensitive exceptions back to the user (CWE-209, CWE-248).
Implementation: Check the results of all functions that return a value and verify that the value is expected.
Implementation: If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).
Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not. Exposing additional information to a potential attacker in the context of an exceptional condition can help the attacker determine what attack vectors are most likely to succeed beyond DoS.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Architecture and Design, Implementation: If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.
Architecture and Design: Use system limits, which should help to prevent resource exhaustion. However, the product should still handle low resource conditions since they may still occur.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2022-36046

Timeline

Aug 30, 2022 Published
Jul 13, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays	Critical	Also affects next
GHSA-2464-fhr4-w9xw Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used	Critical	Also affects next
GHSA-p3m5-59mp-jv5r Next.js: Denial of Service in App Router using Server Actions	High	Also affects next
GHSA-3w37-wq28-93x7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages	Medium	Also affects next
GHSA-4jqv-mc3x-m676 Next.js has cache poisoning of SSG and ISR pages in self-hosted applications	Medium	Also affects next
GHSA-39w2-rjm5-chcv Next.js has information disclosure in development server's Model Context Protocol endpoint	Medium	Also affects next
GHSA-f87g-xv8r-7p7x Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass	Medium	Also affects next
GHSA-mcj8-r9mp-w47p Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service	Medium	Also affects next

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor