CVE-2024-46982— Cache Poisoning in next.js
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-46982
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cache Poisoning in next.js
Source: NVD (National Vulnerability Database)
Vulnerability Description
Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Next.js 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Next.js是Vercel开源的一个 React 框架。 Next.js 13.5.1版本至14.2.10之前版本存在安全漏洞。攻击者利用该漏洞通过发送特制HTTP请求，毒害页面路由器中非动态服务器端呈现路由的缓存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-46982
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | The CVE-2024-46982 is cache poisoning of next_js some site have API to load their image | https://github.com/CodePontiff/next_js_poisoning | POC Details |
| 2 | POC CVE-2024-46982 | https://github.com/Lercas/CVE-2024-46982 | POC Details |
| 3 | None | https://github.com/melmathari/CVE-2024-46982-NUCLEI | POC Details |
| 4 | Reproduction of CVE-2024-46982 | https://github.com/samuel871211/CVE-2024-46982-Reproduction | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-46982
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: next.js
- CVE-2026-29057
Next.js: HTTP request smuggling in rewrites - CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust - CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to Do - CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks - CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF check
Same vendor: vercel
- CVE-2026-29057
Next.js: HTTP request smuggling in rewrites - CVE-2026-27980
Next.js: Unbounded next/image disk cache growth can exhaust - CVE-2026-27979
Next.js: Unbounded postponed resume buffering can lead to Do - CVE-2026-27978
Next.js: null origin can bypass Server Actions CSRF checks - CVE-2026-27977
Next.js: null origin can bypass dev HMR websocket CSRF check
Same weakness: CWE-639
- CVE-2026-8196
JeecgBoot mLogin Endpoint LoginController.java authorization - CVE-2026-42291
SysReptor: Read-write access to personal notes by sharing-li - CVE-2026-44400
MailEnable Enterprise Premium < 10.55 Authorization Bypass v - CVE-2026-42279
solidtime: Time entry update endpoint allows cross-organizat - CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated
V. Comments for CVE-2024-46982
No comments yet