CVE-2023-46298

Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a denial of service to all users requesting the same URL via that CDN.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13	Product
https://github.com/vercel/next.js/issues/45301	Exploit Issue Tracking Third Party Advisory
https://github.com/vercel/next.js/pull/54732	Issue Tracking Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vercel:next.js::::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary0::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary1::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary10::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary11::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary12::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary2::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary3::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary4::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary5::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary6::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary7::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary8::::node.js::*
	cpe:2.3:a:vercel:next.js:13.4.20:canary9::::node.js::*

History

28 Oct 2023, 03:30

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
First Time		Vercel Vercel next.js
CPE		cpe:2.3:a:vercel:next.js:13.4.20:canary8::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary10::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary3::::node.js::* cpe:2.3:a:vercel:next.js::::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary9::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary5::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary4::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary7::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary1::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary6::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary12::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary2::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary0::::node.js::* cpe:2.3:a:vercel:next.js:13.4.20:canary11::::node.js::*
References	~~(MISC) https://github.com/vercel/next.js/issues/45301 -~~	(MISC) https://github.com/vercel/next.js/issues/45301 - Exploit, Issue Tracking, Third Party Advisory
References	~~(MISC) https://github.com/vercel/next.js/pull/54732 -~~	(MISC) https://github.com/vercel/next.js/pull/54732 - Issue Tracking, Patch
References	~~(MISC) https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13 -~~	(MISC) https://github.com/vercel/next.js/compare/v13.4.20-canary.12...v13.4.20-canary.13 - Product
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

22 Oct 2023, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-22 03:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-46298

Mitre link : CVE-2023-46298

CVE.ORG link : CVE-2023-46298

JSON object : View

Products Affected

vercel

next.js

CWE

NVD-CWE-noinfo

7.5 /10