GHSA-4jqv-mc3x-m676: Medium severity npm/next vulnerability
Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 16.3.8 - Upgrade
Upgrade
npm/nextto a version that resolves this vulnerability.Fixed in 15.5.27
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects self-hosted Next.js applications using the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages. Deployments on Vercel are not affected.
What can an attacker do without authentication?
A network-accessible attacker can replace a page cache entry with content from a different route. The affected page can then serve incorrect content to every visitor until the cache entry is revalidated.
How can I determine whether my application is exposed?
Check whether the application is self-hosted, uses Next.js Pages Router, and serves SSG or ISR pages. If all of these apply, the application is within the affected deployment conditions described.