{"id":"CVE-2024-34350","published":"2024-05-09T16:07:44Z","modified":"2024-08-02T02:51:11Z","title":"Next.js Vulnerable to HTTP Request Smuggling","vendor":"vercel","product":"next.js","tier":"tail","description":{"text":"Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions. For a request to be exploitable, the affected route also had to be making use of the [rewrites](https://nextjs.org/docs/app/api-reference/next-config-js/rewrites) feature in Next.js. The vulnerability is resolved in Next.js `13.5.1` and newer.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0119,"percentile":0.67828,"provenance":"source"},"cwes":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"}],"references":[{"url":"https://github.com/vercel/next.js/security/advisories/GHSA-77r5-gw3j-2mpf","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.8,"factors":[{"name":"EPSS percentile","points":13.57},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"vercel","affectedVersions":[{"vendor":"vercel","product":"next.js","versions":[">= 13.4.0, < 13.5.1"]}],"affected":[{"ecosystem":"npm","package":"next","vulnerableRanges":[">=13.4.0, <13.5.1"],"patched":["13.5.1"],"from":["GHSA-77r5-gw3j-2mpf"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1482","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-36046","published":"2022-08-31","fixed":"12.2.4","kev":false},{"cve":"CVE-2023-46298","published":"2023-10-22","fixed":"13.4.20-canary.13","kev":false},{"cve":"CVE-2024-39693","published":"2024-07-10","fixed":"13.5.0","kev":false},{"cve":"CVE-2024-34350","published":"2024-05-09","fixed":"13.5.1","kev":false},{"cve":"CVE-2024-34351","published":"2024-05-09","fixed":"14.1.1","kev":false},{"cve":"CVE-2024-47831","published":"2024-10-14","fixed":"14.2.7","kev":false},{"cve":"CVE-2024-46982","published":"2024-09-17","fixed":"14.2.10","kev":false,"link":{"from":"CVE-2024-34350","to":"CVE-2024-46982","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:next","fromFixed":"13.5.1","toFixed":"13.5.7","daysApart":131}]}}],"package":"npm:next"}}