« Volver al listado

CVE-2024-46982

Estado: AnalizadaAlta (7.5)—💥 PoC

Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3.

Leer descripción completaMostrar menos

Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (1)

Vercel — Next.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46982",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-46982",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-18T13:38:27.573625Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "vercel",
          "product": "next.js",
          "versions": [
            {
              "status": "affected",
              "version": ">= 13.5.1, < 13.5.7"
            },
            {
              "status": "affected",
              "version": ">= 14.0.0, < 14.2.10"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*"
          ],
          "vendor": "vercel",
          "product": "next.js",
          "versions": [
            {
              "status": "affected",
              "version": "13.5.1",
              "lessThan": "13.5.7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "14.0.0",
              "lessThan": "14.2.10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-17T22:15:02.273",
  "references": [
    {
      "url": "https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Next.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: 1. Next.js between 13.5.1 and 14.2.9, 2. Using pages router, & 3. Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx`. This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version."
    },
    {
      "lang": "es",
      "value": "Next.js es un framework React para crear aplicaciones web full-stack. Al enviar una solicitud HTTP manipulada, es posible envenenar el caché de una ruta renderizada del lado del servidor no dinámica en el enrutador de páginas (esto no afecta al enrutador de aplicaciones). Cuando se envía esta solicitud manipulada, podría obligar a Next.js a almacenar en caché una ruta que no debe almacenarse en caché y enviar un encabezado `Cache-Control: s-maxage=1, stale-while-revalidate` que algunas CDN ascendentes también pueden almacenar en caché. Para verse potencialmente afectado, se deben aplicar todas las siguientes condiciones: 1. Next.js entre 13.5.1 y 14.2.9, 2. Usar el enrutador de páginas y 3. Usar rutas renderizadas del lado del servidor no dinámicas, por ejemplo, `pages/dashboard.tsx` no `pages/blog/[slug].tsx`. Esta vulnerabilidad se resolvió en Next.js v13.5.7, v14.2.10 y posteriores. Recomendamos actualizar independientemente de si se puede reproducir el problema o no. No existen workarounds oficiales ni recomendadas para este problema, recomendamos que los usuarios instalen el parche a una versión segura."
    }
  ],
  "lastModified": "2026-06-17T07:56:18.697",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4B5C2B2-E2A7-475C-BF89-FF45209D07FA",
              "versionEndExcluding": "13.5.7",
              "versionStartIncluding": "13.5.1"
            },
            {
              "criteria": "cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8C9B500-1B1F-463C-99A2-6301CD7476AE",
              "versionEndExcluding": "14.2.10",
              "versionStartIncluding": "14.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}