CVE-2022-36046

Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting AND using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server). Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.

• CWE-248
• CWE-754

• https://github.com/vercel/next.js/releases/tag/v12.2.4Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3Third Party Advisory
• https://github.com/vercel/next.js/releases/tag/v12.2.4Release Notes, Third Party Advisory
• https://github.com/vercel/next.js/security/advisories/GHSA-wff4-fpwg-qqv3Third Party Advisory

Published

Aug 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36040Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36041Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36042Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36043Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36044Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2022-36045NodeBB Forum Software is powered by Node.js and supports eit…9.8
• CVE-2022-36048Zulip is an open-source team collaboration tool with topic-b…4.3
• CVE-2022-36049Flux2 is a tool for keeping Kubernetes clusters in sync with…7.5
• CVE-2022-3605The WP CSV Exporter WordPress plugin before 1.3.7 does not p…7.8
• CVE-2022-36051ZITADEL combines the ease of Auth0 and the versatility of Ke…8.8
• CVE-2022-36052Contiki-NG is an open-source, cross-platform operating syste…8.8
• CVE-2022-36053Contiki-NG is an open-source, cross-platform operating syste…8.8