CVE-2024-46982 (GCVE-0-2024-46982)

Vulnerability from cvelistv5 – Published: 2024-09-17 21:55 – Updated: 2024-09-18 13:45
VLAI?
Summary
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
Impacted products
Vendor Product Version
vercel next.js Affected: >= 13.5.1, < 13.5.7
Affected: >= 14.0.0, < 14.2.10
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "next.js",
            "vendor": "vercel",
            "versions": [
              {
                "lessThan": "13.5.7",
                "status": "affected",
                "version": "13.5.1",
                "versionType": "custom"
              },
              {
                "lessThan": "14.2.10",
                "status": "affected",
                "version": "14.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-18T13:38:27.573625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-18T13:45:21.409Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "next.js",
          "vendor": "vercel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 13.5.1, \u003c 13.5.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 14.0.0, \u003c 14.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, \u0026 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-17T21:55:04.312Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9"
        },
        {
          "name": "https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3"
        },
        {
          "name": "https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda"
        }
      ],
      "source": {
        "advisory": "GHSA-gp8f-8m3g-qvj9",
        "discovery": "UNKNOWN"
      },
      "title": "Cache Poisoning in next.js"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-46982",
    "datePublished": "2024-09-17T21:55:04.312Z",
    "dateReserved": "2024-09-16T16:10:09.018Z",
    "dateUpdated": "2024-09-18T13:45:21.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, \u0026 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.\"}, {\"lang\": \"es\", \"value\": \"Next.js es un framework React para crear aplicaciones web full-stack. Al enviar una solicitud HTTP manipulada, es posible envenenar el cach\\u00e9 de una ruta renderizada del lado del servidor no din\\u00e1mica en el enrutador de p\\u00e1ginas (esto no afecta al enrutador de aplicaciones). Cuando se env\\u00eda esta solicitud manipulada, podr\\u00eda obligar a Next.js a almacenar en cach\\u00e9 una ruta que no debe almacenarse en cach\\u00e9 y enviar un encabezado `Cache-Control: s-maxage=1, stale-while-revalidate` que algunas CDN ascendentes tambi\\u00e9n pueden almacenar en cach\\u00e9. Para verse potencialmente afectado, se deben aplicar todas las siguientes condiciones: 1. Next.js entre 13.5.1 y 14.2.9, 2. Usar el enrutador de p\\u00e1ginas y 3. Usar rutas renderizadas del lado del servidor no din\\u00e1micas, por ejemplo, `pages/dashboard.tsx` no `pages/blog/[slug].tsx`. Esta vulnerabilidad se resolvi\\u00f3 en Next.js v13.5.7, v14.2.10 y posteriores. Recomendamos actualizar independientemente de si se puede reproducir el problema o no. No existen workarounds oficiales ni recomendadas para este problema, recomendamos que los usuarios instalen el parche a una versi\\u00f3n segura.\"}]",
      "id": "CVE-2024-46982",
      "lastModified": "2024-09-20T12:30:51.220",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2024-09-17T22:15:02.273",
      "references": "[{\"url\": \"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9\", \"source\": \"security-advisories@github.com\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-639\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46982\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-09-17T22:15:02.273\",\"lastModified\":\"2025-09-10T15:46:05.173\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, \u0026 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.\"},{\"lang\":\"es\",\"value\":\"Next.js es un framework React para crear aplicaciones web full-stack. Al enviar una solicitud HTTP manipulada, es posible envenenar el cach\u00e9 de una ruta renderizada del lado del servidor no din\u00e1mica en el enrutador de p\u00e1ginas (esto no afecta al enrutador de aplicaciones). Cuando se env\u00eda esta solicitud manipulada, podr\u00eda obligar a Next.js a almacenar en cach\u00e9 una ruta que no debe almacenarse en cach\u00e9 y enviar un encabezado `Cache-Control: s-maxage=1, stale-while-revalidate` que algunas CDN ascendentes tambi\u00e9n pueden almacenar en cach\u00e9. Para verse potencialmente afectado, se deben aplicar todas las siguientes condiciones: 1. Next.js entre 13.5.1 y 14.2.9, 2. Usar el enrutador de p\u00e1ginas y 3. Usar rutas renderizadas del lado del servidor no din\u00e1micas, por ejemplo, `pages/dashboard.tsx` no `pages/blog/[slug].tsx`. Esta vulnerabilidad se resolvi\u00f3 en Next.js v13.5.7, v14.2.10 y posteriores. Recomendamos actualizar independientemente de si se puede reproducir el problema o no. No existen workarounds oficiales ni recomendadas para este problema, recomendamos que los usuarios instalen el parche a una versi\u00f3n segura.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"13.5.1\",\"versionEndExcluding\":\"13.5.7\",\"matchCriteriaId\":\"B4B5C2B2-E2A7-475C-BF89-FF45209D07FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"14.0.0\",\"versionEndExcluding\":\"14.2.10\",\"matchCriteriaId\":\"E8C9B500-1B1F-463C-99A2-6301CD7476AE\"}]}]}],\"references\":[{\"url\":\"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-18T13:38:27.573625Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*\"], \"vendor\": \"vercel\", \"product\": \"next.js\", \"versions\": [{\"status\": \"affected\", \"version\": \"13.5.1\", \"lessThan\": \"13.5.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"14.0.0\", \"lessThan\": \"14.2.10\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-18T13:45:13.928Z\"}}], \"cna\": {\"title\": \"Cache Poisoning in next.js\", \"source\": {\"advisory\": \"GHSA-gp8f-8m3g-qvj9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"vercel\", \"product\": \"next.js\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 13.5.1, \u003c 13.5.7\"}, {\"status\": \"affected\", \"version\": \"\u003e= 14.0.0, \u003c 14.2.10\"}]}], \"references\": [{\"url\": \"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9\", \"name\": \"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3\", \"name\": \"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda\", \"name\": \"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, \u0026 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-09-17T21:55:04.312Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46982\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-18T13:45:21.409Z\", \"dateReserved\": \"2024-09-16T16:10:09.018Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-09-17T21:55:04.312Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.