CVE-2022-21721

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/vercel/next.js/pull/33503Patch, Third Party Advisory
https://github.com/vercel/next.js/releases/tag/v12.0.9Release Notes, Third Party Advisory
https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5xThird Party Advisory
https://github.com/vercel/next.js/pull/33503Patch, Third Party Advisory
https://github.com/vercel/next.js/releases/tag/v12.0.9Release Notes, Third Party Advisory
https://github.com/vercel/next.js/security/advisories/GHSA-wr66-vrwm-5g5xThird Party Advisory

Timeline

Published: Jan 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-217229.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217239.1PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2022-217249.8pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security rese CVE-2022-217256.5Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a CVE-2022-217268.8Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and CVE-2022-217278.8Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer CVE-2022-217288.1Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate CVE-2022-217296.5Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by CVE-2022-21736.1The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attr CVE-2022-217308.1Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalAvgPoolGrad` does not consider cases where the inp CVE-2022-217316.5Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denia CVE-2022-217326.5Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service