CVE-2023-46298

published 2023-10-22

CVE-2023-46298: Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service…

Priority P3 39 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
next	next	>= 0.9.9 < 13.4.20-canary.13	13.4.20-canary.13
vercel	next.js	< 13.4.20	13.4.20
vercel	next.js	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.