HighGHSA-gp8f-8m3g-qvj9CVE-2024-46982

Next.js Cache Poisoning

Published 17 Sept 2024 · Updated 10 Sept 2026

Affected packages

nextnpm
Affected
>=13.5.1 <13.5.7
Fixed in
13.5.7
Update to the fixed version for your release line, for example:npm install next@13.5.7
nextnpm
Affected
>=14.0.0 <14.2.10
Fixed in
14.2.10
Update to the fixed version for your release line, for example:npm install next@14.2.10

Details

Impact

By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a Cache-Control: s-maxage=1, stale-while-revalidate header which some upstream CDNs may cache as well.

To be potentially affected all of the following must apply:

  • Next.js between 13.5.1 and 14.2.9
  • Using pages router
  • Using non-dynamic server-side rendered routes e.g. pages/dashboard.tsx not pages/blog/[slug].tsx

The below configurations are unaffected:

  • Deployments using only app router
  • Deployments on Vercel are not affected

Patches

This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not.

Workarounds

There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

Credits

  • Allam Rachid (zhero_)
  • Henry Chen

Is GHSA-gp8f-8m3g-qvj9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected next, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.