-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper input validation in request handling. The GitHub commit 6d98b4f shows added try-catch blocks around the request processing logic in next-server.ts, specifically handling DecodeError and invalid URLs. The patch adds error handling that returns 400 responses instead of allowing crashes. This matches the CWE-20 (Improper Input Validation) classification and the vulnerability description of server crashes from malformed URLs. The handleRequest() function is the entry point for request processing where URL validation occurs, making it the clear vulnerable component before patching.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| next | npm | >= 12.0.0, < 12.0.5 | 12.0.5 |
| next | npm | >= 0.9.9, < 11.1.3 | 11.1.3 |
JavaScriptJavaScriptOngoing coverage of React2Shell