Cross-site request forgery In next
Description
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service Next.js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel10 | - | - | |
rpm rhel7 | - | - | |
rpm rhel8 | - | - | |
rpm rhel9 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
rpm rhel9 | - | - | |
 npm | 16.3.8, 15.5.27 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4. 5.