CVE-2024-46982

Deeper analysis

Next.js, the React framework for full-stack web applications, contains a cache-poisoning flaw that affects non-dynamic server-side rendered routes when the pages router is in use. An attacker who sends a specially crafted HTTP request can force the framework to cache a route that should not be cached and to emit a Cache-Control: s-maxage=1, stale-while-revalidate header that some upstream CDNs will also honor. The issue is limited to versions 13.5.1 through 14.2.9; the app router and dynamic routes such as pages/blog/[slug].tsx are unaffected.

Because the attack requires only an unauthenticated network request, any remote adversary can trigger the poisoning. Successful exploitation results in the server or CDN serving incorrect or stale content for the targeted route, producing a high-impact availability condition as reflected in the CVSS 7.5 score and CWE-639 classification.

The official GitHub Security Advisory and the patches merged in commits 7ed7f125e and bd164d53a state that the vulnerability is resolved in Next.js 13.5.7, 14.2.10, and later releases. No official workarounds are recommended; the advisory explicitly advises upgrading regardless of whether the issue can be reproduced in a given deployment. The associated EPSS score reached a peak of 0.5262 and currently stands at 0.4906.