Description

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Remediation

References

https://github.com/vercel/next.js/issues/45301

https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13

https://github.com/vercel/next.js/pull/54732

Related Vulnerabilities

CVE-2022-1291 Vulnerability in maven package org.webjars.npm:github-com-hhurz-tableexport-jquery-plugin

CVE-2020-13110 Vulnerability in npm package kerberos

CVE-2013-6348 Vulnerability in maven package org.apache.struts:struts2-config-browser-plugin

CVE-2023-26492 Vulnerability in npm package directus

CVE-2021-37305 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Exploit Issue Tracking Third Party Advisory Product Patch NVD-CWE-noinfo