Platform
nodejs
Component
next
Fixed in
13.5.2
14.0.1
13.5.7
CVE-2024-46982 describes a cache poisoning vulnerability in Next.js, specifically impacting routes utilizing the pages router. An attacker can craft a malicious HTTP request to coerce Next.js into caching a route that should not be cached, potentially leading to data exposure. This vulnerability affects versions 13.5.1 through 14.2.9 and has been addressed in version 13.5.7.
The core impact of CVE-2024-46982 lies in the potential for cache poisoning. By sending a carefully crafted HTTP request, an attacker can manipulate Next.js's caching mechanism for non-dynamic server-side rendered routes in the pages router. This can result in the caching of sensitive data or responses that should not be publicly accessible. If an upstream Content Delivery Network (CDN) respects the Cache-Control: s-maxage=1, stale-while-revalidate header, the poisoned cache can be distributed globally, significantly expanding the attack surface. The vulnerability does not affect the app router, limiting its scope but still posing a risk to applications relying on the pages router.
CVE-2024-46982 was publicly disclosed on September 17, 2024. While no active exploitation campaigns have been reported, the availability of a proof-of-concept could lead to opportunistic attacks. The vulnerability is not currently listed on the CISA KEV catalog. The relatively straightforward nature of the attack and the widespread use of Next.js warrant careful attention and prompt remediation.
Exploit Status
EPSS
49.06% (98% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-46982 is to upgrade to Next.js version 13.5.7 or later. This version includes a fix that prevents the cache poisoning vulnerability. If an immediate upgrade is not feasible, consider implementing stricter caching policies on your CDN to prevent caching of responses with the s-maxage header. Review your Next.js application's routing configuration to ensure that non-dynamic server-side rendered routes are properly configured and not susceptible to manipulation. After upgrading, verify the fix by sending a crafted HTTP request similar to the one described in the vulnerability report and confirming that the route is not cached as expected.
Update Next.js to version 13.5.7, 14.2.10, or higher. This corrects the cache poisoning vulnerability in non-dynamic server-side rendered routes in the pages router. The update is the recommended solution, regardless of whether you can reproduce the issue.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-46982 is a vulnerability affecting Next.js versions 13.5.1 - 14.2.9 where a crafted HTTP request can poison the cache of non-dynamic routes, potentially exposing sensitive data.
You are affected if you are using Next.js versions 13.5.1 through 14.2.9 and utilizing the pages router with non-dynamic server-side rendered routes.
Upgrade to Next.js version 13.5.7 or later to remediate the vulnerability. Consider stricter CDN caching policies as an interim measure.
No active exploitation campaigns have been reported, but the vulnerability's ease of exploitation warrants prompt remediation.
Refer to the official Next.js security advisory: https://github.com/vercel/next.js/security/advisories/GHSA-7949-5343-4993
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.