CVE-2024-46982

Description

### Impact By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: - Next.js between 13.5.1 and 14.2.9 - Using pages router - Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx` The below configurations are unaffected: - Deployments using only app router - Deployments on [Vercel](https://vercel.com/) are not affected ### Patches This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. ### Workarounds There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version. #### Credits - Allam Rachid (zhero_) - Henry Chen

How to fix CVE-2024-46982

To remediate CVE-2024-46982, upgrade the affected package to a fixed version below.

• —upgrade to 13.5.7 or later

Is CVE-2024-46982 being exploited?

Moderate — EPSS is 49.1%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• >= 13.5.1, < 13.5.7

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-46982
• PATCHgithub.com/vercel/next.js
• WEBgithub.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
• WEBgithub.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda