Denial of Service Vulnerability in Next.js by Vercel
CVE-2023-46298

7.5HIGH

Key Information:

Vendor

Vercel
Status
Next.js
Vendor
CVE Published:
22 October 2023

What is CVE-2023-46298?

Next.js prior to version 13.4.20-canary.13 contains a vulnerability due to the absence of a cache-control header, which can lead to empty prefetch responses being cached by Content Delivery Networks (CDNs). This caching behavior may inadvertently cause a denial of service for users attempting to access the same URL via the CDN, resulting in interruptions in service and accessibility issues.

References

https://github.com/vercel/next.js/pull/54732
https://github.com/vercel/next.js/issues/45301
https://github.com/vercel/next.js/compare/v13.4.20-canary...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.