Unexpected server crash in Next.js

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.3 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2022-36046: 1.19% estimated exploitation activity in the next 30 days; percentile 67.87 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact When specific requests are made to the Next.js server it can cause an unhandledRejection in the server which can crash the process to exit in specific Node.js versions with strict unhandledRejection handling. - Affected: All of the following must be true to be affected by this CVE - Node.js version above v15.0.0 being used with strict unhandledRejection exiting - Next.js version v12.2.3 - Using next start or a custom server - Not affected: Deployments on Vercel (vercel.com) are not affected along with similar environments where next-server isn't being shared across requests. Patches https://github.com/vercel/next.js/releases/tag/v12.2.4

Published by the source

30 Aug 2022, 20:38 UTC

Last modified by the source

13 Jul 2026, 07:15 UTC

Source last checked

26 Oct 2026, 12:17 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-wff4-fpwg-qqv3

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record PYSEC-2022-43188

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-wff4-fpwg-qqv3

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2022-36046

Advisory: Unexpected server crash in Next.js
IDs: CVE-2022-36046, GHSA-wff4-fpwg-qqv3
Record: https://patchnext.com/advisories/cve-2022-36046 (revision 3, source checked 26 Oct 2026, 12:17 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: next 12.2.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm next: affected >= 12.2.3, <= 12.2.3; fixed in 12.2.4
- PyPI nextjs: affected <= 12.2.3

## Suggested inspection (read-only)
- `npm ls next --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.
- `python -m pip show nextjs`: prints the installed version. Run with the environment that serves production active.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on next, nextjs.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-wff4-fpwg-qqv3 (OSV record GHSA-wff4-fpwg-qqv3 lists affected ranges: npm next >=12.2.3 <12.2.4 (fixed))
- Verified: https://osv.dev/vulnerability/PYSEC-2022-43188 (OSV record PYSEC-2022-43188 lists affected ranges: PyPI nextjs >=0 <=12.2.3)
- Verified: https://github.com/advisories/GHSA-wff4-fpwg-qqv3 (GitHub-reviewed advisory GHSA-wff4-fpwg-qqv3 lists affected ranges: npm next >=12.2.3 <=12.2.3)

Commands are suggestions: review each one before running it.