Next.js Race Condition to Cache Poisoning
Affected releases · next
- 15.x15.0.0 – 15.1.5Fixed in 15.1.6
- 14.x14.0.0 – 14.2.23Fixed in 14.2.24
- 13.x and older0.9.9 – 13.5.11No fix, no longer updated
On 15.x, the newest line:
npm install next@15.1.6Not affected
16.0.0 – 16.4.2
45 releases, latest
Affected
15.0.0 – 15.1.5
15 releases
Fixed
15.1.6 – 15.5.28
67 releases
Affected
14.0.0 – 14.2.23
34 releases
Fixed
14.2.24 – 14.2.35
12 releases
Affected
13.0.0 – 13.5.11
56 releases
Affected
12.0.0 – 12.3.7
33 releases
Affected
11.0.0 – 11.1.4
7 releases
Affected
10.0.0 – 10.2.3
18 releases
Affected
9.0.0 – 9.5.5
38 releases
Affected
8.0.0 – 8.1.0
6 releases
Affected
7.0.0 – 7.0.3
4 releases
Affected
6.0.0 – 6.1.2
7 releases
Affected
5.0.0 – 5.1.0
2 releases
Affected
4.0.0 – 4.2.3
15 releases
Affected
3.0.1 – 3.2.3
11 releases
Affected
2.0.0 – 2.4.9
17 releases
Affected
1.0.0 – 1.2.3
10 releases
Not affected
0.1.0 – 0.4.1
23 releases
Affected
0.9.9 – 0.9.11
3 releases
Is your project affected?
Paste your package.json, or type the range you declare for next. It is read in your browser and sent nowhere.
What happens
Summary
We received a responsible disclosure from Allam Rachid (zhero) for a low-severity race-condition vulnerability in Next.js. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML.
Credit
Thank you to Allam Rachid (zhero) for the responsible disclosure. This research was rewarded as part of our bug bounty program.