Packages / next / Security

LowVulnerabilityGHSA-c59h-r6p8-q9wcCVE-2023-46298Published 22 Oct 2023

Next.js missing cache-control header may lead to CDN caching empty reply

Affected releases · next

  • 13.x13.0.0 – 13.4.19Fixed in 13.5.0
  • 12.x and older0.9.9 – 12.3.7No fix, no longer updated

On 13.x, the newest line:

npm install next@13.5.0
16.x

  1. Not affected

    16.0.0 – 16.4.2

    45 releases, latest

13.x

  1. Affected

    13.0.0 – 13.4.19

    44 releases

  2. Fixed

    13.5.0 – 13.5.11

    12 releases

12.x

  1. Affected

    12.0.0 – 12.3.7

    33 releases

11.x

  1. Affected

    11.0.0 – 11.1.4

    7 releases

10.x

  1. Affected

    10.0.0 – 10.2.3

    18 releases

9.x

  1. Affected

    9.0.0 – 9.5.5

    38 releases

8.x

  1. Affected

    8.0.0 – 8.1.0

    6 releases

7.x

  1. Affected

    7.0.0 – 7.0.3

    4 releases

6.x

  1. Affected

    6.0.0 – 6.1.2

    7 releases

5.x

  1. Affected

    5.0.0 – 5.1.0

    2 releases

4.x

  1. Affected

    4.0.0 – 4.2.3

    15 releases

3.x

  1. Affected

    3.0.1 – 3.2.3

    11 releases

2.x

  1. Affected

    2.0.0 – 2.4.9

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    10 releases

0.x

  1. Not affected

    0.1.0 – 0.4.1

    23 releases

  2. Affected

    0.9.9 – 0.9.11

    3 releases

423 stable releases of next, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.

What happens

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN. Cloudflare considers these requests cacheable assets.