LowGHSA-c59h-r6p8-q9wcCVE-2023-46298
Next.js missing cache-control header may lead to CDN caching empty reply
Published 22 Oct 2023 · Updated 8 Nov 2023
Affected package
nextnpm
- Affected
- >=0.9.9 <13.4.20-canary.13
- Fixed in
- 13.4.20-canary.13
Update to the fixed version for your release line, for example:
npm install next@13.4.20-canary.13Details
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.
Is GHSA-c59h-r6p8-q9wc in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-46298
- Linkgithub.com/vercel/next.js/issues/45301
- Linkgithub.com/vercel/next.js/pull/54732
- Linkgithub.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648
- Packagegithub.com/vercel/next.js
- Linkgithub.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.