CVE-2024-34350 Next.js Vulnerable to HTTP Request Smuggling

High 7.5 Published 9 May 2024 Updated 2 Aug 2024

Attackers can poison response queues via HTTP request smuggling in Next.js apps using rewrites, potentially exposing or modifying data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-34350?

CVE-2024-34350 is a high-severity vulnerability in Vercel Next.js, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP request meant that requests are treated as both a single request, and two separate requests by Next.js, leading to desynchronized responses. This led to a response queue poisoning vulnerability in the affected Next.js versions. For a request to be exploitable, the affected route also had to be making use of the [rewrites](https://nextjs.org/docs/app/api-reference/next-config-js/rewrites) feature in Next.js. The vulnerability is resolved in Next.js `13.5.1` and newer.

Weakness: CWE-444

Which versions are affected by CVE-2024-34350?

2 open source packages ship an affected version, including next. It affects 1 product.

Package	Affected	Fixed in
`next` npm	From `13.4.0`	`13.5.1`
`next` npm	From `13.4.0`	`13.5.1`

Products include Vercel Next.js.

How do I fix CVE-2024-34350?

Upgrade next to 13.5.1 or later.

Is CVE-2024-34350 being exploited?

There is no known exploitation of CVE-2024-34350 in the wild and no public exploit code.

All Vercel Next.js vulnerabilities

Sources

Also known as GHSA-77r5-gw3j-2mpf, ROOT-APP-NPM-CVE-2024-34350.