CVE-2024-46982: Next.js Cache Poisoning
(updated )
By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.
To be potentially affected all of the following must apply:
- Next.js between 13.5.1 and 14.2.9
- Using pages router
- Using non-dynamic server-side rendered routes e.g.
pages/dashboard.tsxnotpages/blog/[slug].tsx
The below configurations are unaffected:
- Deployments using only app router
- Deployments on Vercel are not affected
References
- github.com/advisories/GHSA-gp8f-8m3g-qvj9
- github.com/vercel/next.js
- github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
- github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
- github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
- nvd.nist.gov/vuln/detail/CVE-2024-46982
Code Behaviors & Features
Detect and mitigate CVE-2024-46982 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →