From 76d7108c2483efda94932190425301ac13853335 Mon Sep 17 00:00:00 2001 From: Matt Silverlock Date: Mon, 24 Mar 2025 16:39:06 -0400 Subject: [PATCH] changelog: update versions --- .../workers/2025-03-22-next-js-vulnerability-waf.mdx | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/content/changelog/workers/2025-03-22-next-js-vulnerability-waf.mdx b/src/content/changelog/workers/2025-03-22-next-js-vulnerability-waf.mdx index ee240307ff736a0..b05f454b338db79 100644 --- a/src/content/changelog/workers/2025-03-22-next-js-vulnerability-waf.mdx +++ b/src/content/changelog/workers/2025-03-22-next-js-vulnerability-waf.mdx @@ -12,7 +12,9 @@ date: 2025-03-22T13:00:00Z import { Image } from 'astro:assets'; import managedRuleNextJsAuth from "~/assets/images/changelog/workers/high-res-CVE-2025-29927.gif" -**Update**: We have changed this WAF rule to opt-in only, as sites that use auth middleware with third-party auth vendors were observing failing requests. +**Update: Mon Mar 24th, 8PM UTC**: Next.js has now [backported the patch for this vulnerability](https://github.com/advisories/GHSA-f82v-jwr5-mffw) to cover Next.js v12 and v13. Users on those versions will need to patch to `13.5.9` and `12.3.5` (respectively) to mitigate the vulnerability. + +**Update: Sat Mar 22nd, 4PM UTC**: We have changed this WAF rule to opt-in only, as sites that use auth middleware with third-party auth vendors were observing failing requests. **We strongly recommend updating your version of Next.js (if eligible)** to the patched versions, as your app will otherwise be vulnerable to an authentication bypass attack regardless of auth provider. @@ -61,6 +63,7 @@ We've made a WAF (Web Application Firewall) rule available to all sites on Cloud * This managed rule protects sites using Next.js on Workers and Pages, as well as sites using Cloudflare to protect Next.js applications hosted elsewhere. * This rule has been made available (but not enabled by default) to all sites as part of our [WAF Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) and blocks requests that attempt to bypass authentication in Next.js applications. -* The vulnerability affects almost all Next.js versions, and is patched in Next.js `14.2.25` and `15..2.3`. **Users on older versions of Next.js (`11.1.4` to `13.5.6`) do not have a patch available**. +* The vulnerability affects almost all Next.js versions, and is patched in Next.js `14.2.25` and `15.2.3`. +* **Users on older versions of Next.js (`11.1.4` to `13.5.6`) did not originally have a patch available**, but this the patch for this vulnerability has been backported and to Next.js `12.3.5` and `13.5.9` as of Monday, March 24th. Users on Next.js v11 will need to deploy the stated workaround or enable the WAF rule. The managed WAF rule mitigates this by blocking _external_ user requests with the `x-middleware-subrequest` header regardless of Next.js version, but we recommend users using Next.js 14 and 15 upgrade to the patched versions of Next.js as an additional mitigation.