Next.js v16.2.12 Fix for Improper Redirect Parameter Encoding

Vulnerability Overview This vulnerability involves improper encoding of redirect parameter values in the Next.js framework. Specifically, when processing redirect parameters, certain special characters were not correctly encoded, leading to potential security risks. Affected Scope Affected Version: Next.js v16.2.12 Affected Modules: , , , , , , , , , Remediation Steps 1. Update Error Messages: Updated error messages in to ensure more accurate error prompts when unsupported body types or invalid target hostnames are encountered. 2. Improve URL Processing: Improved URL handling logic in to ensure special characters are correctly encoded during URL processing. 3. Enhance Destination Preparation Logic: Enhanced the destination preparation logic in to ensure special characters are correctly encoded when processing target URLs. 4. Update Dependencies: Updated the dependency version in to ensure the latest patched version is used. 5. Patch Updates: Patched the library in to fix encoding issues in URL processing. 6. Test Cases: Added new test cases in the directory to ensure the patched code correctly handles various special cases. POC Code ```javascript // patches/http-proxy@1.18.1.patch diff --git a/lib/http-proxy/common.js b/lib/http-proxy/common.js index 6513e128d0d5250ea24fbaa337f18ecce07807c7c..0839d08cc90f7af3d53c3d5eedc97e8c0c7c4798 100644 --- a/lib/http-proxy/common.js +++ b/lib/http-proxy/common.js @@ -1,5 +1,9 @@ var common = exports; -var url = require('url'); +var url = require('url'); +var parseUrl = require('url').parse; +var common = require('next/dist/shared/lib/router/utils/parse-url').parseUrl; +var required = require('requires-port'); var upgradeHeader = /(^ @@ -16,7 +20,16 @@ common.setupOutgoing = function(outgoing, options, req, forward) { // Simple Regex for testing if protocol is https outgoing.protocol = outgoing.protocol // Parse a url with Next.js' WebAuth-based 'parseUrl' and adopts the result to // the legacy url.parse shape http-proxy relies on (host, path, and a // bracket-less hostname for IPv6). var parsedUrl = common.parseUrl(req.url); var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostname; var bracketedHostname = parsedUrl.hostnam

Goal Reached Thanks to every supporter — we hit 100%!

Next.js v16.2.12 Fix for Improper Redirect Parameter Encoding

More from this source