PkgSeer

Vulnerability GHSA-4jqv-mc3x-m676

Medium Risk

7 hours ago

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

15.0.0 - 15.5.26 and 16.0.0 - 16.3.7

Summary

Next.js has cache poisoning of SSG and ISR pages in self-hosted applications

Details

Self-hosted Next.js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated. Applications deployed on Vercel are not affected.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

16.3.0 - 16.3.7 GHSA-3w37-wq28-93x7

Next.js: Remote Code Execution in next/og ImageResponse

16.2.0 - 16.3.5 GHSA-vcvr-r3jv-pc5j

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

10.0.0 - 15.5.23 and 16.0.0 - 16.3.2 GHSA-2xp9-vwfh-vxw4

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

13.4.0 - 15.5.23 and 16.0.0 - 16.3.2 GHSA-p293-qw3h-jr36

Next.js: Server-Side Request Forgery in Server Actions on custom servers

14.1.1 - 15.5.20 and 16.0.0 - 16.2.10 GHSA-89xv-2m56-2m9x

View all vulnerabilities for these packages

Impacted packages

next

Timeline

Published

7 hours ago

Fixed (15.5.27)

Unknown

Fixed (16.3.8)

Unknown

Last Modified

7 hours ago