PT-2023-29944 · Next.Js · Next.Js

Muntamala · Publicado 2023-10-21 · Atualizado 2025-05-30 · CVE-2023-46298

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Next.js versions prior to 13.4.20-canary.13

Description The issue is related to the lack of a cache-control header in Next.js, which can cause empty prefetch responses to be cached by a CDN. This can lead to a denial of service for all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.

Recommendations For versions prior to 13.4.20-canary.13, consider updating to a version that includes the necessary cache-control header to prevent empty prefetch responses from being cached by a CDN. As a temporary workaround, consider configuring your CDN to not cache empty prefetch responses.

Exploit

Correção

Identificadores relacionados

CVE-2023-46298

GHSA-C59H-R6P8-Q9WC

Produtos afetados

Next.Js

Referências · 14

• 🔥 https://github.com/vercel/next.js/issues/45301 · Exploit
• https://github.com/vercel/next.js · Nota
• https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13 · Nota
• https://github.com/vercel/next.js/pull/54732 · Correção
• https://github.com/vercel/next.js/commit/20d05958ff853e9c9e42139ffec294336881c648 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-46298 · Nota de Segurança
• https://twitter.com/UMichBlockchain/status/1927560607563149364 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-c59h-r6p8-q9wc · Aviso do Fabricante
• https://t.me/cvenotify/59907 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46298 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1715965240708366566 · Publicação no Twitter
• https://twitter.com/zhero___/status/1928584492194595261 · Publicação no Twitter
• https://twitter.com/Ev3rPalestine/status/1738284815227441344 · Publicação no Twitter
• https://t.me/cibsecurity/72737 · Publicação no Telegram