CVE-2024-37162

Summary

CVE-2024-37162 affects the zsa library used in Next.js for building typesafe server actions. In production mode, this library transfers parse error stacks from the server to the client, potentially exposing sensitive information like machine usernames and directory paths. An attacker could exploit this vulnerability to gain unauthorized access to server environments, using the exposed information for further attacks or infrastructure reconnaissance. This issue has been resolved with the release of version `0.3.3`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.