CVE-2023-46298: High severity next.js vulnerability
Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-46298?
CVE-2023-46298 is a vulnerability found in Next.js version before 13.4.20-canary.13 that lacks a cache-control header and may cause empty prefetch responses to be cached by a CDN, leading to a denial of service for users.
How does CVE-2023-46298 affect Next.js?
CVE-2023-46298 affects Next.js before version 13.4.20-canary.13 by not including a cache-control header, allowing empty prefetch responses to be cached by a CDN and causing a denial of service for users.
What is the impact of CVE-2023-46298?
The impact of CVE-2023-46298 is a denial of service for users requesting the same URL via a CDN due to the caching of empty prefetch responses.
How can I fix CVE-2023-46298 in Next.js?
To fix CVE-2023-46298 in Next.js, upgrade to version 13.4.20-canary.13 or later, which includes the necessary cache-control header.
Where can I find more information about CVE-2023-46298?
You can find more information about CVE-2023-46298 in the GitHub pull request (https://github.com/vercel/next.js/pull/54732) and issues (https://github.com/vercel/next.js/issues/45301) related to the vulnerability.