Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation.
Applications deployed on Vercel are not affected. This issue is fixed in versions 15.5.27 and 16.3.8.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Vercel Next.Js
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
|
15.0.0
|
15.5.27
|
|
Vercel Next.Js
cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
|
16.0.0
|
16.3.8
|
References 5
https://github.com/vercel/next.js/commit/52c94abdd2ea5f416f5e8353ea8a2edd3fe311…
security-advisories@github.com
https://github.com/vercel/next.js/commit/719e4c67d6e92df60246f95e1d96e2dd60789a…
security-advisories@github.com
https://github.com/vercel/next.js/releases/tag/v15.5.27
security-advisories@github.com
https://github.com/vercel/next.js/releases/tag/v16.3.8
security-advisories@github.com
https://github.com/vercel/next.js/security/advisories/GHSA-4jqv-mc3x-m676
security-advisories@github.com